From: Jeffrey Altman <jaltman@secure-endpoints.com>
Date: Tue, 8 Jan 2008 06:29:47 +0000 (+0000)
Subject: DEVEL15-windows-printf-format-string-protection-20080108
X-Git-Tag: openafs-devel-1_5_30a~14
X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=0d94d0921baa779847d8f4345a4ae2a11b2f4911;p=packages%2Fo%2Fopenafs.git

DEVEL15-windows-printf-format-string-protection-20080108

LICENSE MIT

Do not pass strings generated from incoming network data to ??printf
as the format string.  Instead use a format string of "%s".  This protects
against %? expansions being inserted in the string.


(cherry picked from commit a05df915505ab3e77e46e39a5b232086c43fc8bf)
---

diff --git a/src/WINNT/afsd/smb3.c b/src/WINNT/afsd/smb3.c
index b08257021..41a914fa0 100644
--- a/src/WINNT/afsd/smb3.c
+++ b/src/WINNT/afsd/smb3.c
@@ -170,7 +170,7 @@ void OutputDebugHexDump(unsigned char * buffer, int len) {
     for (i=0;i<len;i++) {
         if(!(i%16)) {
             if(i) {
-                osi_Log0(smb_logp, osi_LogSaveString(smb_logp, buf));
+                osi_Log0(smb_logp, "%s", osi_LogSaveString(smb_logp, buf));
                 strcat(buf,"\r\n");
                 OutputDebugString(buf);
             }
@@ -191,7 +191,7 @@ void OutputDebugHexDump(unsigned char * buffer, int len) {
         buf[j] = (k>32 && k<127)?k:'.';
     }    
     if(i) {
-        osi_Log0(smb_logp, osi_LogSaveString(smb_logp, buf));
+        osi_Log0(smb_logp, "%s", osi_LogSaveString(smb_logp, buf));
         strcat(buf,"\r\n");
         OutputDebugString(buf);
     }