Re: [Licq-devel] LICQ string format vulnerability?

[Dima K <di...@ya...>]

--- Pascal Meunier <pme...@pu...> wrote:
> In the file icqpacket.cpp, line 1253, there's a call to snprintf
> where a
> variable string, szState, occuppies the position of the format
> string.


It's actually on line 2785 in current CVS, but he's right, this should
be fixed.

diff -u -b -p -r1.87 icqpacket.cpp
--- icqpacket.cpp       24 May 2003 12:26:43 -0000      1.87
+++ icqpacket.cpp       30 May 2003 22:07:40 -0000
@@ -2782,7 +2782,7 @@ CPU_Meta_SetWorkInfo::CPU_Meta_SetWorkIn
   char szStatebuf[6];

   szStatebuf[5] = '\0';
-  snprintf(szStatebuf, 5, szState);
+  snprintf(szStatebuf, 5, "%s", szState);

   int packetSize = 2+2+2+4+2+2+2 + strlen_safe(szCity) +
strlen_safe(szStatebuf) + strlen_safe(szPhoneNumber) +
                    strlen_safe(szFaxNumber) + strlen_safe(szAddress) +
strlen_safe(szZip) + 2 + strlen_safe(szName) +


__________________________________
Do you Yahoo!?
Yahoo! Calendar - Free online calendar with sync to Outlook(TM).
http://calendar.yahoo.com