Changeset 8412869


Ignore:
Timestamp:
Feb 11, 2009, 12:20:20 PM (11 years ago)
Author:
Nelson Elhage <nelhage@mit.edu>
Branches:
master, debian, release-1.4, release-1.5, release-1.6, release-1.7, release-1.8, release-1.9
Children:
44a61ac
Parents:
7d471c3
git-author:
Nelson Elhage <nelhage@mit.edu> (02/08/09 19:29:24)
git-committer:
Nelson Elhage <nelhage@mit.edu> (02/11/09 12:20:20)
Message:
zcrypt.c: Fix an unsafe use of sprintf()

Reported-By: Geoffrey Thomas <geofft@mit.edu>
File:
1 edited

Legend:

Unmodified
Added
Removed
  • zcrypt.c

    rb9cb41b r8412869  
    423423char *GetZephyrVarKeyFile(char *whoami, char *class, char *instance) {
    424424  char *keyfile = NULL;
    425   char varname[MAX_SEARCH][128];
     425  char *varname[MAX_SEARCH];
    426426  int length[MAX_SEARCH], i;
    427427  char buffer[MAX_BUFF];
    428   char filename[MAX_BUFF];
     428  char *filename;
    429429  char result[MAX_SEARCH][MAX_BUFF];
    430430  int numsearch = 0;
    431431  FILE *fsearch;
    432432
     433  memset(varname, 0, sizeof(varname));
     434
    433435  /* Determine names to look for in .crypt-table */
    434436  if (instance) {
    435     sprintf(varname[numsearch++], "crypt-%s-%s:", (class?class:"message"), instance);
     437    varname[numsearch++] = owl_sprintf("crypt-%s-%s:", (class?class:"message"), instance);
    436438  }
    437439  if (class) {
    438     sprintf(varname[numsearch++], "crypt-%s:", class);
    439   }
    440   sprintf(varname[numsearch++], "crypt-default:");
     440    varname[numsearch++] = owl_sprintf("crypt-%s:", class);
     441  }
     442  varname[numsearch++] = owl_strdup("crypt-default:");
    441443
    442444  /* Setup the result array, and determine string lengths */
     
    447449
    448450  /* Open~/.crypt-table */
    449   sprintf(filename, "%s/.crypt-table", getenv("HOME"));
     451  filename = owl_sprintf("%s/.crypt-table", getenv("HOME"));
    450452  fsearch = fopen(filename, "r");
    451453  if (fsearch) {
     
    495497  }
    496498
     499  for(i = 0; i < MAX_SEARCH; i++) {
     500    owl_free(varname[i]);
     501  }
     502
     503  owl_free(filename);
     504
    497505  return(keyfile);
    498506}
Note: See TracChangeset for help on using the changeset viewer.