More security fixes

Cleaned up whitespace in MIMEState.c++, added a glibc check after
mkstemp() in faxmail, fixed a possible overflow logging in HylaFAXServer.c++,
also fixed another potential overflow in imgtofax.c

All these are thanks to Thomas Biege(thomas@suse.com).

diff --git a/faxmail/MIMEState.c++ b/faxmail/MIMEState.c++
index 734b9c1c2d012b74df6bf537d9209897d9bb2aa0..e679653d3ac5002c976443b21e863c44d326c34b 100644 (file)
--- a/faxmail/MIMEState.c++
+++ b/faxmail/MIMEState.c++
@@ -304,52 +304,56 @@ MIMEState::getLine(FILE* fd, fxStackBuffer& buf)
     buf.reset();
     switch (encode) {
     case ENC_7BIT:
-       for (;;) {
-           int c = getc(fd);
-           if (c == EOF)
-               return (buf.getLength() > 0);
-           c &= 0xff;
-           if (c == '\n') {                    // check for boundary marker
-               lineno++;
-               u_int cc = buf.getLength();
-               if (cc >= blen && buf[0] == '-') {
-                   if (cc == blen && strneq(buf, boundary, blen))
-                       return (false);
-                   if (cc == blen+2 && strneq(buf, boundary, blen+2)) {
-                       lastPart = true;
-                       return (false);
-                   }
-               }
-               buf.put('\n');
-               return (true);
-           }
-           buf.put(c);
-       }
-       /*NOTREACHED*/
+        for (;;) {
+            int c = getc(fd);
+            if (c == EOF) {
+                return (buf.getLength() > 0);
+            }
+            c &= 0xff;
+            if (c == '\n') {                   // check for boundary marker
+                   lineno++;
+                   u_int cc = buf.getLength();
+                   if (cc >= blen && buf[0] == '-') {
+                       if (cc == blen && strneq(buf, boundary, blen)) {
+                               return (false);
+                    }
+                       if (cc == blen+2 && strneq(buf, boundary, blen+2)) {
+                               lastPart = true;
+                               return (false);
+                       }
+               }
+                buf.put('\n');
+                return (true);
+            }
+            buf.put(c);
+        }
+           /*NOTREACHED*/
     case ENC_8BIT:
     case ENC_BINARY:
-       for (;;) {
-           int c = getc(fd);
-           if (c == EOF)
-               return (buf.getLength() > 0);
-           c &= 0xff;
-           if (c == '\n') {                    // check for boundary marker
-               lineno++;
-               u_int cc = buf.getLength();
-               if (cc >= blen && buf[0] == '-') {
-                   if (cc == blen && strneq(buf, boundary, blen))
-                       return (false);
-                   if (cc == blen+2 && strneq(buf, boundary, blen+2)) {
-                       lastPart = true;
-                       return (false);
-                   }
-               }
-               buf.put('\n');
-               return (true);
-           }
-           buf.put(c);
-       }
-       /*NOTREACHED*/
+        for (;;) {
+            int c = getc(fd);
+            if (c == EOF) {
+                   return (buf.getLength() > 0);
+            }
+            c &= 0xff;
+            if (c == '\n') {                   // check for boundary marker
+                   lineno++;
+                u_int cc = buf.getLength();
+                if (cc >= blen && buf[0] == '-') {
+                    if (cc == blen && strneq(buf, boundary, blen)) {
+                        return (false);
+                    }
+                       if (cc == blen+2 && strneq(buf, boundary, blen+2)) {
+                           lastPart = true;
+                       return (false);
+                    }
+                   }
+                buf.put('\n');
+                return (true);
+            }
+            buf.put(c);
+        }
+           /*NOTREACHED*/
     case ENC_QPRINT:   return getQuotedPrintableLine(fd, buf);
     case ENC_BASE64:   return getBase64Line(fd, buf);
     case ENC_UUENCODE: return getUUDecodeLine(fd, buf);

diff --git a/faxmail/faxmail.c++ b/faxmail/faxmail.c++
index 91ce9e4558cf304cf191e3aebc782dfd1d10f2ba..0e1d677c4eda6b2b8d1af19ca5d58bba0bae9a7f 100644 (file)
--- a/faxmail/faxmail.c++
+++ b/faxmail/faxmail.c++
@@ -312,8 +312,13 @@ faxMailApp::run(int argc, char** argv)
     char tmpl[128];
     sprintf(tmpl, "%s/faxmailXXXXXX", _PATH_TMP);
        int fd = Sys::mkstemp(tmpl);
-       if (fd < 0)
-           fxFatal("Cannot create temp file %s", (const char*) tmpl);
+       if (fd < 0) {
+        fxFatal("Cannot create temp file %s", (const char*) tmpl);
+    }
+    // security add for glibc < 2.0.7
+    if (fchmod(fd, 600) == -1) {
+        fxFatal("%s: %s", (const char*) tmpl, strerror(errno));
+    }
        tmps.append(tmpl);
        client->addFile(tmpl);
        beginFormatting(fdopen(fd, "w"));

diff --git a/hfaxd/HylaFAXServer.c++ b/hfaxd/HylaFAXServer.c++
index 35aed0add1427e189a0a59425a9744e4fcb8911d..2bfda421b4b727242b8e4a81a013363429bf5676 100644 (file)
--- a/hfaxd/HylaFAXServer.c++
+++ b/hfaxd/HylaFAXServer.c++
@@ -158,22 +158,24 @@ HylaFAXServer::initServer(void)
 static void
 tiffErrorHandler(const char* module, const char* fmt0, va_list ap)
 {
-    char fmt[128];
-    if (module != NULL)
-       sprintf(fmt, "%s: Warning, %s.", module, fmt0);
-    else
-       sprintf(fmt, "Warning, %s.", fmt0);
+    char fmt[128] = {0};
+    if (module != NULL) {
+        snprintf(fmt, sizeof(fmt) -1, "%s: Warning, %s.", module, fmt0);
+    } else {
+        snprintf(fmt, sizeof(fmt) - 1, "Warning, %s.", fmt0);
+    }
     vlogError(fmt, ap);
 }
 
 static void
 tiffWarningHandler(const char* module, const char* fmt0, va_list ap)
 {
-    char fmt[128];
-    if (module != NULL)
-       sprintf(fmt, "%s: Warning, %s.", module, fmt0);
-    else
-       sprintf(fmt, "Warning, %s.", fmt0);
+    char fmt[128] = {0};
+    if (module != NULL) {
+        snprintf(fmt, sizeof(fmt) -1, "%s: Warning, %s.", module, fmt0);
+    } else {
+        snprintf(fmt, sizeof(fmt) -1, "Warning, %s.", fmt0);
+    }
     vlogWarning(fmt, ap);
 }
 

diff --git a/sgi2fax/imgtofax.c b/sgi2fax/imgtofax.c
index ed931542c92978297f1ff414019ad031b4bbd266..6bce73e52cc553e3ea3f3efeae50ad441bf9233c 100644 (file)
--- a/sgi2fax/imgtofax.c
+++ b/sgi2fax/imgtofax.c
@@ -214,7 +214,7 @@ imgtofax(char* input, int pn)
     TIFFSetField(tif, TIFFTAG_PAGENUMBER, pn, npages);
     TIFFSetField(tif, TIFFTAG_CLEANFAXDATA, CLEANFAXDATA_CLEAN);
     { char buf[1024];
-      sprintf(buf, "Ditherered B&W version of %s", input);
+      snprintf(buf, sizeof(buf) - 1, "Ditherered B&W version of %s", input);
       TIFFSetField(tif, TIFFTAG_IMAGEDESCRIPTION, buf);
     }
     TIFFSetField(tif, TIFFTAG_SOFTWARE, "sgi2fax");