[26804] in Source-Commits
Re: /svn/athena r25764 - in trunk/athena/bin/discuss: client
daemon@ATHENA.MIT.EDU (Benjamin Kaduk)
Thu Sep 13 18:43:59 2012
Date: Thu, 13 Sep 2012 18:43:50 -0400 (EDT)
From: Benjamin Kaduk <kaduk@MIT.EDU>
To: Jonathan D Reed <jdreed@MIT.EDU>
cc: source-commits@MIT.EDU
In-Reply-To: <201209132105.q8DL5flS026332@drugstore.mit.edu>
Message-ID: <alpine.GSO.1.10.1209131843110.861@multics.mit.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
ACK.
On Thu, 13 Sep 2012, Jonathan D Reed wrote:
> Author: jdreed
> Date: 2012-09-13 17:05:41 -0400 (Thu, 13 Sep 2012)
> New Revision: 25764
>
> Modified:
> trunk/athena/bin/discuss/client/addmtg.c
> trunk/athena/bin/discuss/debian/changelog
> Log:
> In discuss:
> * Fix buffer overflow when re-adding meeting (Trac: #973)
>
>
> Modified: trunk/athena/bin/discuss/client/addmtg.c
> ===================================================================
> --- trunk/athena/bin/discuss/client/addmtg.c 2012-09-13 18:37:00 UTC (rev 25763)
> +++ trunk/athena/bin/discuss/client/addmtg.c 2012-09-13 21:05:41 UTC (rev 25764)
> @@ -368,7 +368,8 @@
> int *code;
> {
> name_blk *nbp,temp_nb;
> - char question[100];
> + const char *prompt = "Meeting %s already exists.\nDo you wish to delete the old one and add the new one? ";
> + char *question = NULL;
> int j;
>
> /* see if we're already attending... */
> @@ -382,14 +383,20 @@
> for (j = 0; new_nbp->aliases[j] != NULL; j++) {
> dsc_get_mtg (user_id, new_nbp->aliases[j], &temp_nb, code);
> if (*code == 0) { /* already exists */
> - sprintf (question, "Meeting %s already exists.\nDo you wish to delete the old one and add the new one? ",new_nbp -> aliases[j]);
> + question = malloc(strlen(prompt) - 2 + strlen(new_nbp -> aliases[j]) + 1);
> + if (! question) {
Some style guides mandate comparing pointers against NULL instead of
treating them as boolean values.
However, discuss ... doesn't really have a style guide.
-Ben
> + fprintf(stderr, "Couldn't malloc. Too bad...");
> + return;
> + }
> + sprintf (question, prompt, new_nbp -> aliases[j]);
> if (!command_query (question)) {
> printf ("Meeting not added.\n");
> dsc_destroy_name_blk (&temp_nb);
> *code = DISC_ACTION_NOT_PERFORMED;
> + free(question);
> return;
> }
> -
> + free(question);
> del_the_mtg (&temp_nb, code);
> if (*code != 0) {
> dsc_destroy_name_blk (&temp_nb);
>
> Modified: trunk/athena/bin/discuss/debian/changelog
> ===================================================================
> --- trunk/athena/bin/discuss/debian/changelog 2012-09-13 18:37:00 UTC (rev 25763)
> +++ trunk/athena/bin/discuss/debian/changelog 2012-09-13 21:05:41 UTC (rev 25764)
> @@ -5,8 +5,9 @@
> * Cleanup man pages so they don't generate errors
> * Add missing man pages to satisfy Lintian
> * Comply with Lintian's feelings on grammar
> + * Fix buffer overflow when re-adding meeting (Trac: #973)
>
> - -- Jonathan Reed <jdreed@mit.edu> Fri, 07 Sep 2012 15:53:02 -0400
> + -- Jonathan Reed <jdreed@mit.edu> Thu, 13 Sep 2012 17:02:56 -0400
>
> debathena-discuss (10.0.15-0debathena1) unstable; urgency=low
>
>
>
