From 41d9ea697bf5e81e5003ad7b208788223c25536b Mon Sep 17 00:00:00 2001 From: Simon Wilkinson Date: Tue, 26 Feb 2013 22:27:25 +0000 Subject: [PATCH] auth: Fix buffer overflow in afsconf_Open If we fallback to the .AFSCONF file in the user's homedirectory, the results of getenv("HOME") are copied into a fixed length string, without checking for overflows. Instead of risking this, just use asprintf to dynamically construct a string, and free it when we are done. Caught by coverity (#985905) Change-Id: Id8769ede841165d3ff3104143e55767d550d6f87 Reviewed-on: http://gerrit.openafs.org/9292 Tested-by: BuildBot Reviewed-by: Derrick Brashear Reviewed-by: Jeffrey Altman --- src/auth/cellconfig.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/auth/cellconfig.c b/src/auth/cellconfig.c index b0f7d3973..08cc6bedb 100644 --- a/src/auth/cellconfig.c +++ b/src/auth/cellconfig.c @@ -461,10 +461,18 @@ afsconf_Open(const char *adir) fgets(afs_confdir, 128, fp); fclose(fp); } else { - char pathname[256]; + char *pathname = NULL; + + asprintf(&pathname, "%s/%s", home_dir, ".AFSCONF"); + if (pathname == NULL) { + free(tdir); + UNLOCK_GLOBAL_MUTEX; + return (struct afsconf_dir *) 0; + } - sprintf(pathname, "%s/%s", home_dir, ".AFSCONF"); fp = fopen(pathname, "r"); + free(pathname); + if (fp == 0) { /* Our last chance is the "/.AFSCONF" file */ fp = fopen("/.AFSCONF", "r"); -- 2.39.5