diff options
author | Andrew Tridgell <tridge@samba.org> | 1998-05-11 06:38:36 +0000 |
---|---|---|
committer | Andrew Tridgell <tridge@samba.org> | 1998-05-11 06:38:36 +0000 |
commit | ee09e9dadb69aaba5a751dd20ccc6d587d841bd6 (patch) | |
tree | b7d08dcf7d06d74c7bba90655f720c14cff8981a /source/nmbd/nmbd_serverlistdb.c | |
parent | 6b0c1733d2ebf3b8f09f3bf88b8648d8b371bb1f (diff) | |
download | samba-ee09e9dadb69aaba5a751dd20ccc6d587d841bd6.tar.gz samba-ee09e9dadb69aaba5a751dd20ccc6d587d841bd6.tar.xz samba-ee09e9dadb69aaba5a751dd20ccc6d587d841bd6.zip |
changed to use slprintf() instead of sprintf() just about
everywhere. I've implemented slprintf() as a bounds checked sprintf()
using mprotect() and a non-writeable page.
This should prevent any sprintf based security holes.
Diffstat (limited to 'source/nmbd/nmbd_serverlistdb.c')
-rw-r--r-- | source/nmbd/nmbd_serverlistdb.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/source/nmbd/nmbd_serverlistdb.c b/source/nmbd/nmbd_serverlistdb.c index ea1948cece0..64ca49cdbcc 100644 --- a/source/nmbd/nmbd_serverlistdb.c +++ b/source/nmbd/nmbd_serverlistdb.c @@ -365,10 +365,10 @@ void write_browse_list(time_t t, BOOL force_write) return; } - sprintf(tmp, "\"%s\"", work->work_group); + slprintf(tmp,sizeof(tmp)-1, "\"%s\"", work->work_group); fprintf(fp, "%-25s ", tmp); fprintf(fp, "%08x ", SV_TYPE_DOMAIN_ENUM|SV_TYPE_NT|SV_TYPE_LOCAL_LIST_ONLY); - sprintf(tmp, "\"%s\" ", work->local_master_browser_name); + slprintf(tmp, sizeof(tmp)-1, "\"%s\" ", work->local_master_browser_name); fprintf(fp, "%-30s", tmp); fprintf(fp, "\"%s\"\n", work->work_group); @@ -394,10 +394,10 @@ void write_browse_list(time_t t, BOOL force_write) } /* Output server details, plus what workgroup they're in. */ - sprintf(tmp, "\"%s\"", my_netbios_names[i]); + slprintf(tmp, sizeof(tmp)-1, "\"%s\"", my_netbios_names[i]); fprintf(fp, "%-25s ", tmp); fprintf(fp, "%08x ", stype); - sprintf(tmp, "\"%s\" ", lp_serverstring()); + slprintf(tmp, sizeof(tmp)-1, "\"%s\" ", lp_serverstring()); fprintf(fp, "%-30s", tmp); fprintf(fp, "\"%s\"\n", global_myworkgroup); } @@ -413,11 +413,11 @@ void write_browse_list(time_t t, BOOL force_write) if(wg_type) { - sprintf(tmp, "\"%s\"", work->work_group); + slprintf(tmp, sizeof(tmp)-1, "\"%s\"", work->work_group); fprintf(fp, "%-25s ", tmp); fprintf(fp, "%08x ", wg_type); - sprintf(tmp, "\"%s\" ", work->local_master_browser_name); + slprintf(tmp, sizeof(tmp)-1, "\"%s\" ", work->local_master_browser_name); fprintf(fp, "%-30s", tmp); fprintf(fp, "\"%s\"\n", work->work_group); } @@ -437,10 +437,10 @@ void write_browse_list(time_t t, BOOL force_write) if(serv_type) { /* Output server details, plus what workgroup they're in. */ - sprintf(tmp, "\"%s\"", servrec->serv.name); + slprintf(tmp, sizeof(tmp)-1, "\"%s\"", servrec->serv.name); fprintf(fp, "%-25s ", tmp); fprintf(fp, "%08x ", serv_type); - sprintf(tmp, "\"%s\" ", servrec->serv.comment); + slprintf(tmp, sizeof(tmp)-1, "\"%s\" ", servrec->serv.comment); fprintf(fp, "%-30s", tmp); fprintf(fp, "\"%s\"\n", work->work_group); } |