svn commit: r184779 - head/usr.sbin/cron/crontab

[Kostik Belousov]

On Sun, Nov 09, 2008 at 06:44:53AM +0000, Matteo Riondato wrote:
> Author: matteo
> Date: Sun Nov  9 06:44:53 2008
> New Revision: 184779
> URL: http://svn.freebsd.org/changeset/base/184779
> 
> Log:
>   Be paranoid and use snprintf
>   
>   PR:		bin/122137
>   Submitted by:	Steven Kreuzer <skreuzer at exit2shell.com>
>   MFC after:	3 days
> 
> Modified:
>   head/usr.sbin/cron/crontab/crontab.c
> 
> Modified: head/usr.sbin/cron/crontab/crontab.c
> ==============================================================================
> --- head/usr.sbin/cron/crontab/crontab.c	Sun Nov  9 01:53:06 2008	(r184778)
> +++ head/usr.sbin/cron/crontab/crontab.c	Sun Nov  9 06:44:53 2008	(r184779)
> @@ -263,7 +263,7 @@ list_cmd() {
>  	FILE	*f;
>  
>  	log_it(RealUser, Pid, "LIST", User);
> -	(void) sprintf(n, CRON_TAB(User));
> +	(void) snprintf(n, sizeof(n), CRON_TAB(User));
This note is probably also about paranoia instead of exploitable bug.
I think that it is better to use %s format explicitely instead of
expecting no '%' in the CRON_TAB(User).

>  	if (!(f = fopen(n, "r"))) {
>  		if (errno == ENOENT)
>  			errx(ERROR_EXIT, "no crontab for %s", User);
> @@ -293,7 +293,7 @@ delete_cmd() {
>  	}
>  
>  	log_it(RealUser, Pid, "DELETE", User);
> -	(void) sprintf(n, CRON_TAB(User));
> +	(void) snprintf(n, sizeof(n), CRON_TAB(User));
>  	if (unlink(n)) {
>  		if (errno == ENOENT)
>  			errx(ERROR_EXIT, "no crontab for %s", User);
> @@ -327,7 +327,7 @@ edit_cmd() {
>  	char		new_md5[MD5_SIZE];
>  
>  	log_it(RealUser, Pid, "BEGIN EDIT", User);
> -	(void) sprintf(n, CRON_TAB(User));
> +	(void) snprintf(n, sizeof(n), CRON_TAB(User));
>  	if (!(f = fopen(n, "r"))) {
>  		if (errno != ENOENT)
>  			err(ERROR_EXIT, "%s", n);
> @@ -337,7 +337,7 @@ edit_cmd() {
>  	}
>  
>  	um = umask(077);
> -	(void) sprintf(Filename, "/tmp/crontab.XXXXXXXXXX");
> +	(void) snprintf(Filename, sizeof(Filename), "/tmp/crontab.XXXXXXXXXX");
>  	if ((t = mkstemp(Filename)) == -1) {
>  		warn("%s", Filename);
>  		(void) umask(um);
> @@ -504,8 +504,8 @@ replace_cmd() {
>  		return (-2);
>  	}
>  
> -	(void) sprintf(n, "tmp.%d", Pid);
> -	(void) sprintf(tn, CRON_TAB(n));
> +	(void) snprintf(n, sizeof(n), "tmp.%d", Pid);
> +	(void) snprintf(tn, sizeof(n), CRON_TAB(n));
>  	if (!(tmp = fopen(tn, "w+"))) {
>  		warn("%s", tn);
>  		return (-2);
> @@ -592,7 +592,7 @@ replace_cmd() {
>  		return (-2);
>  	}
>  
> -	(void) sprintf(n, CRON_TAB(User));
> +	(void) snprintf(n, sizeof(n), CRON_TAB(User));
>  	if (rename(tn, n)) {
>  		warn("error renaming %s to %s", tn, n);
>  		unlink(tn);
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/svn-src-all/attachments/20081109/e09cad90/attachment.pgp