lpd: fix OOM vulnerability (was eating arbitrarily large commands)

1 files changed, 6 insertions, 3 deletions

diff --git a/libbb/read.c b/libbb/read.c
index 575446536..9c025e3a3 100644
--- a/libbb/read.c
+++ b/libbb/read.c
@@ -152,13 +152,14 @@ char *reads(int fd, char *buffer, size_t size)
 // Read one line a-la fgets. Reads byte-by-byte.
 // Useful when it is important to not read ahead.
 // Bytes are appended to pfx (which must be malloced, or NULL).
-char *xmalloc_reads(int fd, char *buf)
+char *xmalloc_reads(int fd, char *buf, size_t *maxsz_p)
 {
         char *p;
-        int sz = buf ? strlen(buf) : 0;
+        size_t sz = buf ? strlen(buf) : 0;
+        size_t maxsz = maxsz_p ? *maxsz_p : MAXINT(size_t);
 
         goto jump_in;
-        while (1) {
+        while (sz < maxsz) {
                 if (p - buf == sz) {
  jump_in:
                         buf = xrealloc(buf, sz + 128);
@@ -178,6 +179,8 @@ char *xmalloc_reads(int fd, char *buf)
                 p++;
         }
         *p++ = '\0';
+        if (maxsz_p)
+                *maxsz_p  = p - buf - 1;
         return xrealloc(buf, p - buf);
 }