Commit 37578f2e authored by antirez's avatar antirez
Browse files

Security: fix redis-cli buffer overflow.

Thanks to Fakhri Zulkifli for reporting it.

The fix switched to dynamic allocation, copying the final prompt in the
static buffer only at the end.
parent 299d5a4b
...@@ -151,20 +151,25 @@ static long long mstime(void) { ...@@ -151,20 +151,25 @@ static long long mstime(void) {
} }
static void cliRefreshPrompt(void) { static void cliRefreshPrompt(void) {
int len;
if (config.eval_ldb) return; if (config.eval_ldb) return;
if (config.hostsocket != NULL)
len = snprintf(config.prompt,sizeof(config.prompt),"redis %s", sds prompt = sdsempty();
config.hostsocket); if (config.hostsocket != NULL) {
else prompt = sdscatfmt(prompt,"redis %s",config.hostsocket);
len = anetFormatAddr(config.prompt, sizeof(config.prompt), } else {
config.hostip, config.hostport); char addr[256];
anetFormatAddr(addr, sizeof(addr), config.hostip, config.hostport);
prompt = sdscatlen(prompt,addr,strlen(addr));
}
/* Add [dbnum] if needed */ /* Add [dbnum] if needed */
if (config.dbnum != 0) if (config.dbnum != 0)
len += snprintf(config.prompt+len,sizeof(config.prompt)-len,"[%d]", prompt = sdscatfmt(prompt,"[%i]",config.dbnum);
config.dbnum);
snprintf(config.prompt+len,sizeof(config.prompt)-len,"> "); /* Copy the prompt in the static buffer. */
prompt = sdscatlen(prompt,"> ",2);
snprintf(config.prompt,sizeof(config.prompt),"%s",prompt);
sdsfree(prompt);
} }
/* Return the name of the dotfile for the specified 'dotfilename'. /* Return the name of the dotfile for the specified 'dotfilename'.
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment