CVE-2019-15767

An attacker can trigger this vulnerability by providing a crafted EPD file to the `cmd_load` function. The vulnerability occurs when the filename is too long and lacks newline characters, causing the copying loop to overflow the `data` buffer. This overflow can corrupt the stack, potentially overwriting the base pointer and return address [ref_id=1].

The vulnerability resides in the `cmd_load` function located in the file `frontend/cmd.cc`. Specifically, lines 318-322 contain the problematic `while` loop that copies data from the loaded file to a buffer without proper bounds checking against null terminators [ref_id=1].

The patch modifies the `cmd_load` function to correctly handle the termination condition of the copying loop. Instead of solely relying on newline characters, the loop now also checks for null terminators, preventing the buffer overflow. This ensures that data is copied safely without exceeding the allocated buffer size [ref_id=1].