Your message dated Mon, 31 Mar 2025 00:56:55 -0400
with message-id <E1tz7Ch-00FZ6X-33@guru>
and subject line Re: bug#272724: less: "LESSCLOSE" and "LESSOPEN" format string
problem
has caused the Debian Bug report #272724,
regarding less: "LESSCLOSE" and "LESSOPEN" format string problem
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
272724: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=272724
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: less
Version: 382-1
Severity: normal
Tags: patch
The contents of the environment variables "LESSCLOSE" and "LESSOPEN" are used
as format strings for the function "sprintf" which is called with a fixed number
of arguments. As a result of this, if "LESSCLOSE" or "LESSOPEN" contain
directives other than those which are expected (i.e., two "%s" directives for
"LESSCLOSE" and a single "%s" for "LESSOPEN"), undefined behavior will occur.
I am including a patch which corrects this problem.
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.4.27
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8
Versions of packages less depends on:
ii debianutils 2.9 Miscellaneous utilities specific t
ii libc6 2.3.2.ds1-16 GNU C Library: Shared libraries an
ii libncurses5 5.4-4 Shared libraries for terminal hand
-- no debconf information
--- less-382.old/filename.c 2004-02-04 04:52:27.000000000 +0000
+++ less-382/filename.c 2004-09-21 14:43:38.000000000 +0000
@@ -47,6 +47,8 @@
#endif
#endif
+#include <stdarg.h>
+
extern int force_open;
extern int secure;
@@ -59,6 +61,55 @@
#endif
/*
+ * Substitute arbitrary text for each occurrence of "%s" in a string.
+ */
+static char *sps(const char *str, size_t n, ...)
+{
+ register const char *sub;
+ register char *p0 = (char *) str, *p1;
+ register size_t subl, nc = n, nstrl = 1;
+ va_list ap;
+ va_start(ap, n);
+ sub = va_arg(ap, char *);
+ subl = strlen(sub);
+ nc--;
+ while (*p0)
+ if (*p0 == '%' && p0[1] == 's') {
+ p0 += 2;
+ nstrl += subl;
+ if (nc) {
+ sub = va_arg(ap, char *);
+ subl = strlen(sub);
+ nc--;
+ }
+ } else {
+ p0++;
+ nstrl++;
+ }
+ p1 = p0 = ecalloc(nstrl, 1);
+ va_end(ap);
+ va_start(ap, n);
+ sub = va_arg(ap, char *);
+ subl = strlen(sub);
+ nc = n - 1;
+ while (*str)
+ if (*str == '%' && str[1] == 's') {
+ (void) strcpy(p1, sub);
+ p1 += subl;
+ str += 2;
+ if (nc) {
+ sub = va_arg(ap, char *);
+ subl = strlen(sub);
+ nc--;
+ }
+ } else
+ *p1++ = *str++;
+ va_end(ap);
+ *p1 = 0;
+ return p0;
+}
+
+/*
* Remove quotes around a filename.
*/
public char *
@@ -822,9 +873,7 @@
#endif
}
- cmd = (char *) ecalloc(strlen(lessopen) + strlen(filename) + 2,
- sizeof(char));
- sprintf(cmd, lessopen, filename);
+ cmd = sps(lessopen, 1, filename);
fd = shellcmd(cmd);
free(cmd);
if (fd == NULL)
@@ -900,9 +949,7 @@
}
if ((lessclose = lgetenv("LESSCLOSE")) == NULL)
return;
- cmd = (char *) ecalloc(strlen(lessclose) + strlen(filename) +
- strlen(altfilename) + 2, sizeof(char));
- sprintf(cmd, lessclose, filename, altfilename);
+ cmd = sps(lessclose, 2, filename, altfilename);
fd = shellcmd(cmd);
free(cmd);
if (fd != NULL)
--- End Message ---
--- Begin Message ---
Control: fixed -1 451-1
Fixed upstream:
Author: Mark Nudelman <[email protected]>
Date: Sun May 20 23:46:09 2012 +0000
Validate LESSOPEN and LESSCLOSE variables.
https://github.com/gwsw/less/commit/241afb5b0cdb59a814089b4db6a1dc92aaa43671
--- End Message ---
