e46008a870
Erik Sjolund discovered several issues in enscript: it suffers from several buffer overflows (CAN-2004-1186), quotes and shell escape characters are insufficiently sanitized in filenames (CAN-2004-1185), and it supported taking input from an arbitrary command pipe, with unwanted side effects (CAN-2004-1184). From/via Gentoo.
36 lines
1.0 KiB
Plaintext
36 lines
1.0 KiB
Plaintext
$OpenBSD: patch-src_psgen_c,v 1.1 2005/02/11 19:12:42 naddy Exp $
|
|
--- src/psgen.c.orig Fri Feb 11 20:01:12 2005
|
|
+++ src/psgen.c Fri Feb 11 20:01:25 2005
|
|
@@ -2034,8 +2034,9 @@ dump_ps_page_header (char *fname, int em
|
|
else
|
|
{
|
|
ftail++;
|
|
- strncpy (buf, fname, ftail - fname);
|
|
- buf[ftail - fname] = '\0';
|
|
+ i = ftail - fname >= sizeof (buf)-1 ? sizeof (buf)-1 : ftail - fname;
|
|
+ strncpy (buf, fname, i);
|
|
+ buf[i] = '\0';
|
|
}
|
|
|
|
if (nup > 1)
|
|
@@ -2385,9 +2386,10 @@ recognize_eps_file (Token *token)
|
|
MESSAGE (2, (stderr, "^@epsf=\"%s\"\n", token->u.epsf.filename));
|
|
|
|
i = strlen (token->u.epsf.filename);
|
|
+ /*
|
|
if (i > 0 && token->u.epsf.filename[i - 1] == '|')
|
|
{
|
|
- /* Read EPS data from pipe. */
|
|
+ / * Read EPS data from pipe. * /
|
|
token->u.epsf.pipe = 1;
|
|
token->u.epsf.filename[i - 1] = '\0';
|
|
token->u.epsf.fp = popen (token->u.epsf.filename, "r");
|
|
@@ -2400,6 +2402,7 @@ recognize_eps_file (Token *token)
|
|
}
|
|
}
|
|
else
|
|
+ */
|
|
{
|
|
char *filename;
|
|
|