d6ed1f2713
Format string bug in hfaxd. pointed out by margarida from securityfocus.
22 lines
789 B
Plaintext
22 lines
789 B
Plaintext
$OpenBSD: patch-hfaxd_SNPPServer_c++,v 1.1 2003/11/11 22:30:34 todd Exp $
|
|
--- hfaxd/SNPPServer.c++.orig 2002-02-14 22:20:50.000000000 -0600
|
|
+++ hfaxd/SNPPServer.c++ 2003-11-11 16:26:23.000000000 -0600
|
|
@@ -849,7 +849,7 @@ SNPPServer::dataCmd(void)
|
|
fxStr emsg;
|
|
u_int seqnum = getDocumentNumbers(1, emsg);
|
|
if (seqnum == (u_int) -1) {
|
|
- reply(554, emsg);
|
|
+ reply(554, "%s", (const char*)emsg);
|
|
return;
|
|
}
|
|
msgFile = fxStr::format("/%s/doc%u.page", FAX_TMPDIR, seqnum);
|
|
@@ -1053,7 +1053,7 @@ SNPPServer::messageCmd(const char* msg)
|
|
fxStr emsg;
|
|
u_int seqnum = getDocumentNumbers(1, emsg);
|
|
if (seqnum == (u_int) -1) {
|
|
- reply(554, emsg);
|
|
+ reply(554, "%s", (const char*)emsg);
|
|
return;
|
|
}
|
|
msgFile = fxStr::format("/%s/doc%u.page", FAX_TMPDIR, seqnum);
|