Ripped from Fedora. --- traceroute-1.4a5/traceroute.c.secfix Fri Jun 13 05:30:27 1997 +++ traceroute-1.4a5/traceroute.c Tue Dec 16 12:14:32 1997 @@ -368,6 +368,10 @@ break; case 'g': + if (strlen(optarg) >= MAXHOSTNAMELEN) { + Fprintf(stderr, "%s: Nice Try !\n", prog); + exit(-1); + } if (lsrr >= NGATEWAYS) { Fprintf(stderr, "%s: No more than %d gateways\n", @@ -380,6 +384,11 @@ case 'i': device = optarg; + if (strlen(device) >= 16) { /* that is the IFNAMSIZ + * from kernel headers */ + Fprintf(stderr, "%s: Nice try !\n", prog); + exit(-1); + } break; case 'I': @@ -412,6 +421,10 @@ * probe (e.g., on a multi-homed host). */ source = optarg; + if (strlen(source) >= MAXHOSTNAMELEN) { + Fprintf(stderr, "%s: Nice Try !\n", prog); + exit(-1); + } break; case 't': @@ -470,6 +483,10 @@ case 1: hostname = argv[optind]; + if (strlen(hostname) >= MAXHOSTNAMELEN) { + Fprintf(stderr, "%s: Nice try !\n", prog); + exit(-1); + } hi = gethostinfo(hostname); setsin(to, hi->addrs[0]); if (hi->n > 1)