e46008a870
Erik Sjolund discovered several issues in enscript: it suffers from several buffer overflows (CAN-2004-1186), quotes and shell escape characters are insufficiently sanitized in filenames (CAN-2004-1185), and it supported taking input from an arbitrary command pipe, with unwanted side effects (CAN-2004-1184). From/via Gentoo.
81 lines
1.9 KiB
Plaintext
81 lines
1.9 KiB
Plaintext
$OpenBSD: patch-src_util_c,v 1.1 2005/02/11 19:12:42 naddy Exp $
|
|
--- src/util.c.orig Fri Feb 11 20:01:12 2005
|
|
+++ src/util.c Fri Feb 11 20:01:25 2005
|
|
@@ -1239,6 +1239,8 @@ escape_string (char *string)
|
|
|
|
/* Create result. */
|
|
cp = xmalloc (len + 1);
|
|
+ if (cp == NULL)
|
|
+ return NULL;
|
|
for (i = 0, j = 0; string[i]; i++)
|
|
switch (string[i])
|
|
{
|
|
@@ -1879,6 +1881,7 @@ is_open (InputStream *is, FILE *fp, char
|
|
char *cmd = NULL;
|
|
int cmdlen;
|
|
int i, pos;
|
|
+ char *cp;
|
|
|
|
is->is_pipe = 1;
|
|
|
|
@@ -1902,12 +1905,16 @@ is_open (InputStream *is, FILE *fp, char
|
|
{
|
|
case 's':
|
|
/* Expand cmd-buffer. */
|
|
- cmdlen += strlen (fname);
|
|
- cmd = xrealloc (cmd, cmdlen);
|
|
+ if ((cp = shell_escape (fname)) != NULL)
|
|
+ {
|
|
+ cmdlen += strlen (cp);
|
|
+ cmd = xrealloc (cmd, cmdlen);
|
|
|
|
- /* Paste filename. */
|
|
- strcpy (cmd + pos, fname);
|
|
- pos += strlen (fname);
|
|
+ /* Paste filename. */
|
|
+ strcpy (cmd + pos, cp);
|
|
+ pos += strlen (cp);
|
|
+ free (cp);
|
|
+ }
|
|
|
|
i++;
|
|
break;
|
|
@@ -2115,4 +2122,37 @@ size_t
|
|
buffer_len (Buffer *buffer)
|
|
{
|
|
return buffer->len;
|
|
+}
|
|
+
|
|
+/*
|
|
+ * Escapes the name of a file so that the shell groks it in 'single'
|
|
+ * quotation marks. The resulting pointer has to be free()ed when not
|
|
+ * longer used.
|
|
+*/
|
|
+char *
|
|
+shell_escape(const char *fn)
|
|
+{
|
|
+ size_t len = 0;
|
|
+ const char *inp;
|
|
+ char *retval, *outp;
|
|
+
|
|
+ for(inp = fn; *inp; ++inp)
|
|
+ switch(*inp)
|
|
+ {
|
|
+ case '\'': len += 4; break;
|
|
+ default: len += 1; break;
|
|
+ }
|
|
+
|
|
+ outp = retval = malloc(len + 1);
|
|
+ if(!outp)
|
|
+ return NULL; /* perhaps one should do better error handling here */
|
|
+ for(inp = fn; *inp; ++inp)
|
|
+ switch(*inp)
|
|
+ {
|
|
+ case '\'': *outp++ = '\''; *outp++ = '\\'; *outp++ = '\'', *outp++ = '\''; break;
|
|
+ default: *outp++ = *inp; break;
|
|
+ }
|
|
+ *outp = 0;
|
|
+
|
|
+ return retval;
|
|
}
|