bin/50824: src/usr.sbin/altq/altqstat/quip_client.c:360: huge input data problem ?

[dcb314%hotmail.com@localhost]

>Number:         50824
>Category:       bin
>Synopsis:       src/usr.sbin/altq/altqstat/quip_client.c:360: huge input data problem ?
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Feb 17 12:25:00 +0000 2016
>Originator:     David Binderman
>Release:        cvs dated 20160216
>Organization:
>Environment:
>Description:

[src/usr.sbin/altq/altqstat/quip_client.c:360]: (warning) scanf without field width limits can crash with huge input data.


Source code is

   if (sscanf(buf, "%s", qdisc) != 1)

but buf is populated from 

    result_code = quip_recvresponse(server, NULL, buf, &len);

so function quip_recvresponse can't know how big the buffer
to write into is. So it looks as if a sufficiently large buffer
will crash the function.


>How-To-Repeat:

>Fix: