Attachment 10193 Details for Bug 33107

[patch] Patch for the bugs mentioned in the text

qpopper4.0.4-security.patch (text/plain), 2.21 KB, created by Olaf Kirch on 2002-08-20 23:28:46 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Olaf Kirch

Created: 2002-08-20 23:28:46 UTC

Size: 2.21 KB

patch

obsolete

>--- qpopper4.0.4/common/logit.c.security	Fri Apr  5 04:37:53 2002
>+++ qpopper4.0.4/common/logit.c	Tue Aug 20 17:25:29 2002
>@@ -154,6 +154,10 @@
>     iLeft  = sizeof ( msgbuf ) -3; /* allow for CRLF NULL */
>     iChunk = Qvsnprintf ( msgbuf, iLeft, format, ap );
> 
>+    /* Note: snprintf returns the number of characters that
>+     * would have been written if the buffer had been large
>+     * enough. --okir */
>+
>     /*
>      * Append file name and line number.
>      */
>@@ -161,7 +165,7 @@
>         char whence [ 512 ];
>         int  len;
>         
>-        iLeft -= ( iChunk >= 0 ? iChunk : strlen(msgbuf) );
>+        iLeft -= strlen(msgbuf);
>         len    = Qsprintf ( whence, " [%s:%d]", fn, ln );
>         strncat ( msgbuf, whence, iLeft );
>         msgbuf [ sizeof(msgbuf) -1 ] = '\0'; /* just to make sure */
>@@ -191,7 +195,7 @@
>         syslog ( loglev, "%s", msgbuf) ;
>     }
>     
>-    if ( iChunk == -1 ) {
>+    if ( iChunk >= sizeof(msgbuf) - 1 ) {
>         /* 
>          * We blew out the format buffer.
>          */
>--- qpopper4.0.4/common/snprintf.c.security	Fri Apr  5 04:37:55 2002
>+++ qpopper4.0.4/common/snprintf.c	Tue Aug 20 17:23:51 2002
>@@ -341,7 +341,12 @@
>                     limit  = atoi ( p );
>                 }
>                 else
>-                if ( nState == IN_FORM && bWidth == FALSE ) {
>+		/* This statement originally had nState == IN_FORM
>+		 * but we never get here when in state IN_FORM.
>+		 * They probably meant IN_CONV.
>+		 * If you insist on re-inventing wheels, they invariably
>+		 * turn out to be bumpier that the original. --okir */
>+                if ( nState == IN_CONV && bWidth == FALSE ) {
>                     bWidth = TRUE;
>                     width  = atoi ( p );
>                 }
>--- qpopper4.0.4/popper/popauth.c.security	Tue Aug 20 17:08:22 2002
>+++ qpopper4.0.4/popper/popauth.c	Tue Aug 20 17:11:42 2002
>@@ -747,6 +747,8 @@
>                 fprintf ( stderr, "%s: \"-%s\" unknown option\n", program, cp );
>                 helpful();
>             case TRACESW:
>+		if (getuid())
>+		    adios ( HERE, "you are not allowed to do that" );
>                 debug++;
>                 trace_file = fdopen ( open ( argv[1], O_RDWR|O_CREAT|O_EXCL,0640 ), "a+" );
>                 if ( trace_file == NULL )

Actions: View | Diff

Attachments on bug 33107: 10193