Changeset 2700 in MondoRescue for branches/2.2.9/mondo/src/common/newt-specific.c

Timestamp:

Jan 27, 2011, 7:31:06 PM (13 years ago)

Author:

Bruno Cornec

Message:

r4176@localhost: bruno | 2011-01-26 18:11:02 +0100

• Fix buffer overflow with long exclude lines where log between mindi and mondo were exceeding fixed string size used

File:

• branches/2.2.9/mondo/src/common/newt-specific.c (modified) (5 diffs)

branches/2.2.9/mondo/src/common/newt-specific.c

@@ -471 +471 @@
 
         /*@ buffers ********************************************************** */
-        char *command;
-        char *tmp;
+        char *command = NULL;
+        char *tmp = NULL;
 
         /*@ pointers ********************************************************* */
@@ -480 +480 @@
         int i = 0;
 
-        malloc_string(command);
-        malloc_string(tmp);
         assert_string_is_neither_NULL_nor_zerolength(filename);
         assert(grep_for_me != NULL);
 
         if (!does_file_exist(filename)) {
-            paranoid_free(command);
-            paranoid_free(tmp);
             return;
         }
         if (grep_for_me[0] != '\0') {
-            sprintf(command, "grep '%s' %s | tail -n%d",
+            mr_asprintf(&command, "grep '%s' %s | tail -n%d",
                     grep_for_me, filename, g_noof_log_lines);
         } else {
-            sprintf(command, "tail -n%d %s", g_noof_log_lines,
+            mr_asprintf(&command, "tail -n%d %s", g_noof_log_lines,
                     filename);
         }
@@ -510 +506 @@
                     */
                     if (!strncmp(err_log_lines[i], "root:", 5)) {
-                        strcpy(tmp, err_log_lines[i] + 6);
-                        strcpy(err_log_lines[i], tmp);
+                        mr_asprintf(&tmp, "%s", err_log_lines[i] + 6);
+                        strncpy(err_log_lines[i], tmp, (size_t)MAX_NEWT_COMMENT_LEN);
+                        mr_free(tmp);
                     }
                     if (feof(fin)) {
@@ -520 +517 @@
             paranoid_pclose(fin);
         }
+        mr_free(command);
         refresh_log_screen();
-        paranoid_free(command);
-        paranoid_free(tmp);
     }
 
@@ -545 +541 @@
 
         va_start(args, fmt);
-        vsprintf(output, fmt, args);
+        vsnprintf(output, MAX_STR_LEN-1, fmt, args);
         log_msg(0, output);
         output[80] = '\0';