f705b2b3cc
problems noted in CAN-2004-0914:
Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as
used in XFree86 and other packages, include (1) multiple integer
overflows, (2) out-of-bounds memory accesses, (3) directory
traversal, (4) shell metacharacter, (5) endless loops, and (6)
memory leaks, which could allow remote attackers to obtain
sensitive information, cause a denial of service (application
crash), or execute arbitary code via a certain XPM image file.
Bump PKGREVISION to 4. Since this is a security-related fix, also
bump the BUILDLINK_RECOMMENDED version for this package.
103 lines
3 KiB
Text
103 lines
3 KiB
Text
$NetBSD: patch-ap,v 1.1 2005/06/14 18:10:37 jlam Exp $
|
|
|
|
--- lib/WrFFrI.c.orig 1998-03-19 14:51:00.000000000 -0500
|
|
+++ lib/WrFFrI.c
|
|
@@ -37,6 +37,8 @@
|
|
* Lorens Younes (d93-hyo@nada.kth.se) 4/96
|
|
*/
|
|
|
|
+/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
|
|
+
|
|
#include "XpmI.h"
|
|
#if !defined(NO_ZPIPE) && defined(WIN32)
|
|
# define popen _popen
|
|
@@ -97,7 +99,7 @@ XpmWriteFileFromXpmImage(filename, image
|
|
XpmInfo *info;
|
|
{
|
|
xpmData mdata;
|
|
- char *name, *dot, *s, new_name[BUFSIZ];
|
|
+ char *name, *dot, *s, new_name[BUFSIZ] = {0};
|
|
int ErrorStatus;
|
|
|
|
/* open file to write */
|
|
@@ -119,8 +121,9 @@ XpmWriteFileFromXpmImage(filename, image
|
|
name++;
|
|
#endif
|
|
/* let's try to make a valid C syntax name */
|
|
- if (dot = index(name, '.')) {
|
|
- strcpy(new_name, name);
|
|
+ if (index(name, '.')) {
|
|
+ strncpy(new_name, name, sizeof(new_name));
|
|
+ new_name[sizeof(new_name)-1] = 0;
|
|
/* change '.' to '_' */
|
|
name = s = new_name;
|
|
while (dot = index(s, '.')) {
|
|
@@ -130,7 +133,8 @@ XpmWriteFileFromXpmImage(filename, image
|
|
}
|
|
if (dot = index(name, '-')) {
|
|
if (name != new_name) {
|
|
- strcpy(new_name, name);
|
|
+ strncpy(new_name, name, sizeof(new_name));
|
|
+ new_name[sizeof(new_name)-1] = 0;
|
|
name = new_name;
|
|
}
|
|
/* change '-' to '_' */
|
|
@@ -247,6 +251,8 @@ WritePixels(file, width, height, cpp, pi
|
|
unsigned int x, y, h;
|
|
|
|
h = height - 1;
|
|
+ if (cpp != 0 && width >= (UINT_MAX - 3)/cpp)
|
|
+ return XpmNoMemory;
|
|
p = buf = (char *) XpmMalloc(width * cpp + 3);
|
|
if (!buf)
|
|
return (XpmNoMemory);
|
|
@@ -297,6 +303,11 @@ WriteExtensions(file, ext, num)
|
|
/*
|
|
* open the given file to be written as an xpmData which is returned
|
|
*/
|
|
+#ifndef NO_ZPIPE
|
|
+ FILE *s_popen(char *cmd, const char *type);
|
|
+#else
|
|
+# define s_popen popen
|
|
+#endif
|
|
static int
|
|
OpenWriteFile(filename, mdata)
|
|
char *filename;
|
|
@@ -312,16 +323,23 @@ OpenWriteFile(filename, mdata)
|
|
mdata->type = XPMFILE;
|
|
} else {
|
|
#ifndef NO_ZPIPE
|
|
- int len = strlen(filename);
|
|
+ size_t len = strlen(filename);
|
|
+
|
|
+ if(len == 0 ||
|
|
+ filename[0] == '/' ||
|
|
+ strstr(filename, "../") != NULL ||
|
|
+ filename[len-1] == '/')
|
|
+ return(XpmOpenFailed);
|
|
+
|
|
if (len > 2 && !strcmp(".Z", filename + (len - 2))) {
|
|
- sprintf(buf, "compress > \"%s\"", filename);
|
|
- if (!(mdata->stream.file = popen(buf, "w")))
|
|
+ snprintf(buf, sizeof(buf), "compress > \"%s\"", filename);
|
|
+ if (!(mdata->stream.file = s_popen(buf, "w")))
|
|
return (XpmOpenFailed);
|
|
|
|
mdata->type = XPMPIPE;
|
|
} else if (len > 3 && !strcmp(".gz", filename + (len - 3))) {
|
|
- sprintf(buf, "gzip -q > \"%s\"", filename);
|
|
- if (!(mdata->stream.file = popen(buf, "w")))
|
|
+ snprintf(buf, sizeof(buf), "gzip -q > \"%s\"", filename);
|
|
+ if (!(mdata->stream.file = s_popen(buf, "w")))
|
|
return (XpmOpenFailed);
|
|
|
|
mdata->type = XPMPIPE;
|
|
@@ -352,7 +370,7 @@ xpmDataClose(mdata)
|
|
break;
|
|
#ifndef NO_ZPIPE
|
|
case XPMPIPE:
|
|
- pclose(mdata->stream.file);
|
|
+ fclose(mdata->stream.file);
|
|
break;
|
|
#endif
|
|
}
|