patchsets/motif/2.2.3/16_all_mrm_buffer_overflow.patch


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

http://bugs.gentoo.org/340249
Patch backported from openmotif-2.3.3

--- openMotif-2.2.3-orig/lib/Mrm/MrmIheader.c
+++ openMotif-2.2.3/lib/Mrm/MrmIheader.c
@@ -228,9 +228,10 @@
 
   {
     /* sscanf() may call ungetc(), which would write the XmConst string. */
-    char buf[XtNumber(idb__database_version) + 1];
+    char *buf = XtMalloc(strlen(idb__database_version) + 1);
     strcpy(buf, idb__database_version);
     sscanf(buf, "URM %d.%d", &db_major, &db_minor);
+    XtFree(buf);
   }
     
   if ((file_major > db_major) ||