Hi all,
the attached patch fixes all the remaining pscan warnings. It's part of
my little Kaffe security audit following the security issue in fastjar,
that was fixed by NetBSD developers. pscan is a small tool that checks
for format string uses that allow an attacker to smash the stack.
cheers,
dalibor topic
2006-04-03 Dalibor Topic <[EMAIL PROTECTED]>
Fixed all pscan warnings.
* native/jni/classpath/jcl.c (JCL_ThrowException),
native/jni/classpath/jcl.h (DBG),
native/target/generic/target_generic.h
(TARGET_NATIVE_LAST_ERROR_STRING_FORMAT),
native/target/generic/target_generic_misc.h
(TARGET_NATIVE_MISC_FORMAT_STRING0):
Use "%s" format in fprintf and snprintf explicitely when
printing a single
string to prevent format string exploits.
* native/jni/java-net/javanet.h (DBG): Removed duplicate
definition. Included jcl.h instead.
Index: native/jni/classpath/jcl.c
===================================================================
RCS file: /sources/classpath/classpath/native/jni/classpath/jcl.c,v
retrieving revision 1.22
diff -u -p -r1.22 jcl.c
--- native/jni/classpath/jcl.c 25 Jan 2006 10:40:12 -0000 1.22
+++ native/jni/classpath/jcl.c 3 Apr 2006 13:42:17 -0000
@@ -68,9 +68,9 @@ JCL_ThrowException (JNIEnv * env, const
if (errExcClass == NULL)
{
fprintf (stderr, "JCL: Utterly failed to throw exeption ");
- fprintf (stderr, className);
+ fprintf (stderr, "%s", className);
fprintf (stderr, " with message ");
- fprintf (stderr, errMsg);
+ fprintf (stderr, "%s", errMsg);
return;
}
}
Index: native/jni/classpath/jcl.h
===================================================================
RCS file: /sources/classpath/classpath/native/jni/classpath/jcl.h,v
retrieving revision 1.15
diff -u -p -r1.15 jcl.h
--- native/jni/classpath/jcl.h 25 Jan 2006 10:40:12 -0000 1.15
+++ native/jni/classpath/jcl.h 3 Apr 2006 13:42:17 -0000
@@ -71,7 +71,7 @@ JNIEXPORT void * JNICALL JCL_GetRawData
/* Simple debug macro */
#ifdef DEBUG
-#define DBG(x) fprintf(stderr, (x));
+#define DBG(x) fprintf(stderr, "%s", (x));
#else
#define DBG(x)
#endif
Index: native/jni/java-net/javanet.h
===================================================================
RCS file: /sources/classpath/classpath/native/jni/java-net/javanet.h,v
retrieving revision 1.13
diff -u -p -r1.13 javanet.h
--- native/jni/java-net/javanet.h 6 Feb 2006 07:53:38 -0000 1.13
+++ native/jni/java-net/javanet.h 3 Apr 2006 13:42:17 -0000
@@ -40,6 +40,7 @@ exception statement from your version. *
#define _JAVANET_LOADED
#include <jni.h>
+#include "jcl.h"
/*************************************************************************/
@@ -73,19 +74,6 @@ exception statement from your version. *
/*************************************************************************/
/*
- * Macros
- */
-
-/* Simple debug macro */
-#ifdef DEBUG
-#define DBG(x) fprintf(stderr, (x));
-#else
-#define DBG(x)
-#endif
-
-/*************************************************************************/
-
-/*
* Function Prototypes
*/
Index: native/target/generic/target_generic.h
===================================================================
RCS file: /sources/classpath/classpath/native/target/generic/target_generic.h,v
retrieving revision 1.9
diff -u -p -r1.9 target_generic.h
--- native/target/generic/target_generic.h 25 Jan 2006 10:40:13 -0000 1.9
+++ native/target/generic/target_generic.h 3 Apr 2006 13:42:18 -0000
@@ -148,7 +148,7 @@ Systems : all
#include <errno.h>
#define TARGET_NATIVE_LAST_ERROR_STRING_FORMAT(buffer,bufferSize,format) \
do { \
- sprintf(buffer,format); \
+ sprintf(buffer, "%s", format); \
strcat(" (error: "); \
strcat(strerror(errno)); \
strcat(")"); \
Index: native/target/generic/target_generic_misc.h
===================================================================
RCS file: /sources/classpath/classpath/native/target/generic/target_generic_misc.h,v
retrieving revision 1.16
diff -u -p -r1.16 target_generic_misc.h
--- native/target/generic/target_generic_misc.h 25 Jan 2006 10:40:13 -0000 1.16
+++ native/target/generic/target_generic_misc.h 3 Apr 2006 13:42:18 -0000
@@ -90,7 +90,7 @@ Systems : all
#include <stdarg.h>
#define TARGET_NATIVE_MISC_FORMAT_STRING0(buffer,bufferSize,format) \
do { \
- snprintf(buffer,bufferSize,format); \
+ snprintf(buffer,bufferSize, "%s", format); \
} while (0)
#endif
#ifndef TARGET_NATIVE_MISC_FORMAT_STRING1
