Changeset 823671c

Timestamp:

Feb 11, 2009, 12:20:22 PM (16 years ago)

Author:

Nelson Elhage <nelhage@mit.edu>

Branches:

master, debian, release-1.10, release-1.4, release-1.5, release-1.6, release-1.7, release-1.8, release-1.9

Children:

f34dd65

Parents:

3538bc8

git-author:

Sam Hartman <hartmans@mit.edu> (02/10/09 18:07:17)

git-committer:

Nelson Elhage <nelhage@mit.edu> (02/11/09 12:20:22)

Message:

owl_zwrite_send_message: avoid buffer overflow with to

The variable to was set up with sprintf without bounds checking; use
dynamic allocation.

File:

• zwrite.c (modified) (2 diffs)

zwrite.c

@@ -264 +264 @@
 {
   int i, j;
-  char to[LINE];
+  char *to = NULL;
 
   if (z->message==NULL) return(-1);
@@ -272 +272 @@
     for (i=0; i<j; i++) {
       if (strcmp(z->realm, "")) {
-        sprintf(to, "%s@%s", (char *) owl_list_get_element(&(z->recips), i), z->realm);
+        to = owl_sprintf("%s@%s", (char *) owl_list_get_element(&(z->recips), i), z->realm);
       } else {
-        strcpy(to, owl_list_get_element(&(z->recips), i));
+        to = owl_strdup( owl_list_get_element(&(z->recips), i));
       }
       send_zephyr(z->opcode, z->zsig, z->class, z->inst, to, z->message);
+      owl_free(to);
+      to = NULL;
     }
   } else {
-    sprintf(to, "@%s", z->realm);
+    to = owl_sprintf( "@%s", z->realm);
     send_zephyr(z->opcode, z->zsig, z->class, z->inst, to, z->message);
   }
+  owl_free(to);
   return(0);
 }