| 1 | From b0716eac4e800a0ea53e1b949250f671702f28a0 Mon Sep 17 00:00:00 2001
|
| 2 | From: Tom Callaway <[email protected]>
|
| 3 | Date: Tue, 30 Oct 2012 15:39:24 -0400
|
| 4 | Subject: apply workaround to CVE-2012-4527
|
| 5 |
|
| 6 | |
| 7 | |
| 8 | @@ -41,6 +41,8 @@
|
| 9 | # include <time.h>
|
| 10 | #endif
|
| 11 |
|
| 12 | +#define WIDTH 80
|
| 13 | +
|
| 14 | static char rcsid[] =
|
| 15 | "$Id: mcrypt.c,v 1.2 2007/11/07 17:10:21 nmav Exp $";
|
| 16 |
|
| 17 | @@ -482,7 +484,7 @@
|
| 18 | #ifdef HAVE_STAT
|
| 19 | if (stream_flag == FALSE) {
|
| 20 | if (is_normal_file(file[i]) == FALSE) {
|
| 21 | - sprintf(tmperr,
|
| 22 | + snprintf(tmperr, WIDTH,
|
| 23 | _
|
| 24 | ("%s: %s is not a regular file. Skipping...\n"),
|
| 25 | program_name, file[i]);
|
| 26 | @@ -501,7 +503,7 @@
|
| 27 | dinfile = file[i];
|
| 28 | if ((isatty(fileno((FILE *) (stdin))) == 1)
|
| 29 | && (stream_flag == TRUE) && (force == 0)) { /* not a tty */
|
| 30 | - sprintf(tmperr,
|
| 31 | + snprintf(tmperr, WIDTH,
|
| 32 | _
|
| 33 | ("%s: Encrypted data will not be read from a terminal.\n"),
|
| 34 | program_name);
|
| 35 | @@ -520,7 +522,7 @@
|
| 36 | einfile = file[i];
|
| 37 | if ((isatty(fileno((FILE *) (stdout))) == 1)
|
| 38 | && (stream_flag == TRUE) && (force == 0)) { /* not a tty */
|
| 39 | - sprintf(tmperr,
|
| 40 | + snprintf(tmperr, WIDTH,
|
| 41 | _
|
| 42 | ("%s: Encrypted data will not be written to a terminal.\n"),
|
| 43 | program_name);
|
| 44 | @@ -544,7 +546,7 @@
|
| 45 | strcpy(outfile, einfile);
|
| 46 | /* if file has already the .nc ignore it */
|
| 47 | if (strstr(outfile, ".nc") != NULL) {
|
| 48 | - sprintf(tmperr,
|
| 49 | + snprintf(tmperr, WIDTH,
|
| 50 | _
|
| 51 | ("%s: file %s has the .nc suffix... skipping...\n"),
|
| 52 | program_name, outfile);
|
| 53 | @@ -590,10 +592,10 @@
|
| 54 |
|
| 55 | if (x == 0) {
|
| 56 | if (stream_flag == FALSE) {
|
| 57 | - sprintf(tmperr, _("File %s was decrypted.\n"), dinfile);
|
| 58 | + snprintf(tmperr, WIDTH, _("File %s was decrypted.\n"), dinfile);
|
| 59 | err_warn(tmperr);
|
| 60 | } else {
|
| 61 | - sprintf(tmperr, _("Stdin was decrypted.\n"));
|
| 62 | + snprintf(tmperr, WIDTH, _("Stdin was decrypted.\n"));
|
| 63 | err_warn(tmperr);
|
| 64 | }
|
| 65 | #ifdef HAVE_STAT
|
| 66 | @@ -610,7 +612,7 @@
|
| 67 |
|
| 68 | } else {
|
| 69 | if (stream_flag == FALSE) {
|
| 70 | - sprintf(tmperr,
|
| 71 | + snprintf(tmperr, WIDTH,
|
| 72 | _
|
| 73 | ("File %s was NOT decrypted successfully.\n"),
|
| 74 | dinfile);
|
| 75 | @@ -636,10 +638,10 @@
|
| 76 |
|
| 77 | if (x == 0) {
|
| 78 | if (stream_flag == FALSE) {
|
| 79 | - sprintf(tmperr, _("File %s was encrypted.\n"), einfile);
|
| 80 | + snprintf(tmperr, WIDTH, _("File %s was encrypted.\n"), einfile);
|
| 81 | err_warn(tmperr);
|
| 82 | } else {
|
| 83 | - sprintf(tmperr, _("Stdin was encrypted.\n"));
|
| 84 | + snprintf(tmperr, WIDTH, _("Stdin was encrypted.\n"));
|
| 85 | err_warn(tmperr);
|
| 86 | }
|
| 87 | #ifdef HAVE_STAT
|
| 88 | @@ -655,7 +657,7 @@
|
| 89 |
|
| 90 | } else {
|
| 91 | if (stream_flag == FALSE) {
|
| 92 | - sprintf(tmperr,
|
| 93 | + snprintf(tmperr, WIDTH,
|
| 94 | _
|
| 95 | ("File %s was NOT encrypted successfully.\n"),
|
| 96 | einfile);
|
| 97 | -
|
| 98 | git v0.12
|
| 99 |
|