lib/50823: src/lib/libwrap/hosts_access.c:317: huge input data problem ?

[dcb314%hotmail.com@localhost]

>Number:         50823
>Category:       lib
>Synopsis:       src/lib/libwrap/hosts_access.c:317: huge input data problem ?
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Feb 17 12:10:00 +0000 2016
>Originator:     David Binderman
>Release:        cvs dated 20160216
>Organization:
>Environment:
>Description:

[src/lib/libwrap/hosts_access.c:317]: (warning) scanf without field width limits can crash with huge input data.

Source code is

    while (fscanf(fp, "%s", tok) == 1 && !(match = host_match(tok, host)))
         /* void */ ;

but

    char    tok[BUFSIZ];

so the code assumes all lines in the file are shorter than BUFSIZ
and will smash the stack if they aren't. This might be a security issue.

>How-To-Repeat:

>Fix: