fix sprint_tm buffer size crash (reported by Japheth Cleaver)

diff --git a/ChangeLog b/ChangeLog
index a06be0aec3c0e08cae8b61b41446942194fc3310..8ae5741b3084ce080580a7c17f445477addbb816 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,5 @@
 UNRELEASED
+  * fix sprint_tm buffer size crash (reported by Japheth Cleaver)
   * fping.spec: fix setuid permissions and provides fping6 (Marcus Vinicius Ferreira)
   * fix fping6 build on OS X 10.8 (unknown contributor)
 

diff --git a/src/fping.c b/src/fping.c
index ad646648b8d3014676306ca55c0426756cbf19f4..93337b2b67eae3ed99c252aeab3a53f0a803bd90 100644 (file)
--- a/src/fping.c
+++ b/src/fping.c
@@ -2535,36 +2535,32 @@ char * sprint_tm( int t )
 {
     static char buf[10];
 
-    /* <= 0.99 ms */
-    if( t < 100 )
-    {
+    if( t < 0 ) {
+        /* negative (unexpected) */
+        sprintf( buf, "%.2g", (double) t / 100 );
+    }
+    else if( t < 100 ) {
+        /* <= 0.99 ms */
         sprintf( buf, "0.%02d", t );
-        return( buf );
-
-    }/* IF */
-
-    /* 1.00 - 9.99 ms */
-    if( t < 1000 )
-    {
+    }
+    else if( t < 1000 ) {
+        /* 1.00 - 9.99 ms */
         sprintf( buf, "%d.%02d", t / 100, t % 100 );
-        return( buf );
-
-    }/* IF */
-
-    /* 10.0 - 99.9 ms */
-    if( t < 10000 )
-    {
+    }
+    else if( t < 10000 ) {
+        /* 10.0 - 99.9 ms */
         sprintf( buf, "%d.%d", t / 100, ( t % 100 ) / 10 );
-        return( buf );
-    
-    }/* IF */
-  
-    /* >= 100 ms */
-    sprintf( buf, "%d", t / 100 );
-    return( buf );
-
-} /* sprint_tm() */
+    }
+    else if( t < 100000000 ) {
+        /* 100 - 1'000'000 ms */
+        sprintf( buf, "%d", t / 100 );
+    }
+    else {
+        sprintf( buf, "%.2e", (double) (t / 100) );
+    }
 
+    return( buf );
+}
 
 /************************************************************