missing bounds check in makedepend for file arguments

When assigning source code files from the command line to the fp pointer,
no bounds check is done and if more than MAXFILES file names are specified
on the command line, memory will be overridden out of bounds.

https://bugs.freedesktop.org/show_bug.cgi?id=94099

Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Tested-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/main.c b/main.c
index e73cd8d..e5cb70c 100644
--- a/main.c
+++ b/main.c
@@ -232,6 +232,9 @@ main(int argc, char *argv[])
 			/* treat +thing as an option for C++ */
 			if (endmarker && **argv == '+')
 				continue;
+			if (fp >= filelist + MAXFILES) {
+			    fatalerr("Too many source files. Limit is %i files.\n", MAXFILES);
+			}
 			*fp++ = argv[0];
 			continue;
 		}