File launcher-buffer-overwrite.patch of Package shellinabox
diff -Pdpur shellinabox-2.14.orig/shellinabox/launcher.c shellinabox-2.14/shellinabox/launcher.c
--- shellinabox-2.14.orig/shellinabox/launcher.c 2012-04-21 19:30:44.000000000 +0200
+++ shellinabox-2.14/shellinabox/launcher.c 2013-02-06 15:03:12.205151893 +0100
@@ -523,7 +523,7 @@ int launchChild(int service, struct Sess
request->width = session->width;
request->height = session->height;
strncat(request->peerName, httpGetPeerName(session->http),
- sizeof(request->peerName) - 1);
+ sizeof(request->peerName) - strlen(request->peerName) - 1);
request->urlLength = strlen(u);
memcpy(&request->url, u, request->urlLength);
free(u);
@@ -576,10 +576,10 @@ void initUtmp(struct Utmp *utmp, int use
dcheck(!strncmp(ptyPath, "/dev/pts", 8) ||
!strncmp(ptyPath, "/dev/pty", 8) ||
!strncmp(ptyPath, "/dev/tty", 8));
- strncat(&utmp->utmpx.ut_line[0], ptyPath + 5, sizeof(utmp->utmpx.ut_line) - 1);
- strncat(&utmp->utmpx.ut_id[0], ptyPath + 8, sizeof(utmp->utmpx.ut_id) - 1);
- strncat(&utmp->utmpx.ut_user[0], "SHELLINABOX", sizeof(utmp->utmpx.ut_user) - 1);
- strncat(&utmp->utmpx.ut_host[0], peerName, sizeof(utmp->utmpx.ut_host) - 1);
+ strncat(&utmp->utmpx.ut_line[0], ptyPath + 5, sizeof(utmp->utmpx.ut_line) - strlen(utmp->utmpx.ut_line) - 1);
+ strncat(&utmp->utmpx.ut_id[0], ptyPath + 8, sizeof(utmp->utmpx.ut_id) - strlen(utmp->utmpx.ut_id) - 1);
+ strncat(&utmp->utmpx.ut_user[0], "SHELLINABOX", sizeof(utmp->utmpx.ut_user) - strlen(utmp->utmpx.ut_user) - 1);
+ strncat(&utmp->utmpx.ut_host[0], peerName, sizeof(utmp->utmpx.ut_host) - strlen(utmp->utmpx.ut_host) - 1);
struct timeval tv;
check(!gettimeofday(&tv, NULL));
utmp->utmpx.ut_tv.tv_sec = tv.tv_sec;