bin/45660: Overlapping buffer in catman.c.

[henning.petersen%t-online.de@localhost]

>Number:         45660
>Category:       bin
>Synopsis:       Overlapping buffer in catman.c.
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 27 08:25:00 +0000 2011
>Originator:     Henning Petersen
>Release:        NetBSD-current
>Organization:
>Environment:
>Description:
Overlapping buffer in catman.c with undefined behavior if s[n]printf is
used.
>How-To-Repeat:

>Fix:
diff -u -p -r1.30 catman.c
--- usr.sbin/catman/catman.c    29 Aug 2011 20:38:55 -0000      1.30
+++ usr.sbin/catman/catman.c    19 Nov 2011 12:50:21 -0000
@@ -561,14 +561,16 @@ makecat(const char *manpage, const char 
 {
        char crunchbuf[1024];
        char sysbuf[2048];
+       size_t  len;
 
        snprintf(sysbuf, sizeof(sysbuf), buildcmd, manpage);
 
+       len = strlen(sysbuf);
        if (*crunchcmd != '\0') {
                snprintf(crunchbuf, sizeof(crunchbuf), crunchcmd, catpage);
-               snprintf(sysbuf, sizeof(sysbuf), "%s | %s", sysbuf, crunchbuf);
+               snprintf(sysbuf + len, sizeof(sysbuf) - len, " | %s", 
crunchbuf);
        } else {
-               snprintf(sysbuf, sizeof(sysbuf), "%s > %s", sysbuf, catpage);
+               snprintf(sysbuf + len, sizeof(sysbuf) - len, " > %s", catpage);
        }
 
        if (f_noprint == 0)