[Bug 353219] [NEW] beacon crashes if the length of the destination exceeds 20

[Andreas Schantin]

Public bug reported:

Binary package hint: ax25-tools

The beacon tool crashes if the length of the -d parameter (destination
calls and digipeater path) exceeds a length of 20 characters. This seems
to happen because the destination path (char *destcall) is copied into
addr (char addr[20]) without checking the length. See lines 106 of
beacon.c:

...
105	else if (destcall != NULL) 
106		strcpy(addr, destcall);
...

Checking the length of destcall before copying should solve the problem:
 
	if (strlen(destcall) > 20) {
		fprintf(stderr, "beacon: destination (-d) exceeds allowed length\n");
		return 1;
	} else
	strcpy(addr, destcall);

I'd also propose to increase the length of addr a little since 20
characters seems a little few for longer pathes.

** Affects: ax25-tools (Ubuntu)
     Importance: Undecided
         Status: New

-- 
beacon crashes if the length of the destination exceeds 20
https://bugs.launchpad.net/bugs/353219
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

-- 
ubuntu-bugs mailing list
ubuntu-bugs at lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs