Author: cem
Date: Thu Apr 13 22:59:17 2017
New Revision: 316795
URL: https://svnweb.freebsd.org/changeset/base/316795
Log:
ctm: Fix some trivial argv buffer overruns
It may not do the right thing with these obviously wrong inputs, but at
least it won't smash the stack.
Reported by: Coverity (CWE-120)
CIDs: 1006697, 1006698
Sponsored by: Dell EMC Isilon
Modified:
head/usr.sbin/ctm/ctm_dequeue/ctm_dequeue.c
head/usr.sbin/ctm/ctm_smail/ctm_smail.c
Modified: head/usr.sbin/ctm/ctm_dequeue/ctm_dequeue.c
==============================================================================
--- head/usr.sbin/ctm/ctm_dequeue/ctm_dequeue.c Thu Apr 13 22:07:34 2017
(r316794)
+++ head/usr.sbin/ctm/ctm_dequeue/ctm_dequeue.c Thu Apr 13 22:59:17 2017
(r316795)
@@ -115,7 +115,8 @@ main(int argc, char **argv)
if (ftsent->fts_info != FTS_F || ftsent->fts_name[0] == '.')
continue;
- sprintf(filename, "%s/%s", queue_dir, ftsent->fts_name);
+ snprintf(filename, sizeof(filename), "%s/%s", queue_dir,
+ ftsent->fts_name);
fd = open(filename, O_RDONLY);
if (fd < 0)
{
Modified: head/usr.sbin/ctm/ctm_smail/ctm_smail.c
==============================================================================
--- head/usr.sbin/ctm/ctm_smail/ctm_smail.c Thu Apr 13 22:07:34 2017
(r316794)
+++ head/usr.sbin/ctm/ctm_smail/ctm_smail.c Thu Apr 13 22:59:17 2017
(r316795)
@@ -190,13 +190,13 @@ chop_and_send(FILE *dfp, char *delta, lo
* Construct the tmp queue file name of a delta piece.
*/
#define mk_tmp_name(fn,qd,p) \
- sprintf((fn), "%s/.%08ld.%03d", (qd), (long)getpid(), (p))
+ snprintf((fn), sizeof(fn), "%s/.%08ld.%03d", (qd), (long)getpid(), (p))
/*
* Construct the final queue file name of a delta piece.
*/
#define mk_queue_name(fn,qd,d,p,n) \
- sprintf((fn), "%s/%s+%03d-%03d", (qd), (d), (p), (n))
+ snprintf((fn), sizeof(fn), "%s/%s+%03d-%03d", (qd), (d), (p), (n))
/*
* Carve our CTM delta into pieces, encode them, and queue them.
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
