Author: mwiegand
Date: 2008-09-25 11:55:02 +0200 (Thu, 25 Sep 2008)
New Revision: 1434
Modified:
trunk/openvas-server/ChangeLog
trunk/openvas-server/openvasd/dirutils.c
trunk/openvas-server/openvasd/oval_plugins.c
Log:
* openvasd/oval_plugins.c (ovaldi_launch), openvasd/dirutils.c
(init_directories): Changed unsafe uses of sprintf to use snprintf with
the correct buffer sizes.
Modified: trunk/openvas-server/ChangeLog
===================================================================
--- trunk/openvas-server/ChangeLog 2008-09-25 09:40:27 UTC (rev 1433)
+++ trunk/openvas-server/ChangeLog 2008-09-25 09:55:02 UTC (rev 1434)
@@ -1,5 +1,11 @@
2008-09-25 Michael Wiegand <[EMAIL PROTECTED]>
+ * openvasd/oval_plugins.c (ovaldi_launch), openvasd/dirutils.c
+ (init_directories): Changed unsafe uses of sprintf to use snprintf with
+ the correct buffer sizes.
+
+2008-09-25 Michael Wiegand <[EMAIL PROTECTED]>
+
* MANIFEST: Updated.
2008-09-25 Michael Wiegand <[EMAIL PROTECTED]>
Modified: trunk/openvas-server/openvasd/dirutils.c
===================================================================
--- trunk/openvas-server/openvasd/dirutils.c 2008-09-25 09:40:27 UTC (rev
1433)
+++ trunk/openvas-server/openvasd/dirutils.c 2008-09-25 09:55:02 UTC (rev
1434)
@@ -65,61 +65,61 @@
home_dir = strdup(p);
buf = malloc(4096);
- sprintf(buf, "%s/etc", home_dir);
+ snprintf(buf, 4096, "%s/etc", home_dir);
OPENVASD_CONFDIR = strdup(buf);
- sprintf(buf, "%s/var/openvas", home_dir);
+ snprintf(buf, 4096, "%s/var/openvas", home_dir);
OPENVASD_STATEDIR = strdup(buf);
- sprintf(buf, "%s/etc/openvas", home_dir);
+ snprintf(buf, 4096, "%s/etc/openvas", home_dir);
OPENVASD_DATADIR = strdup(buf);
- sprintf(buf, "%s/lib/openvas", home_dir);
+ snprintf(buf, 4096, "%s/lib/openvas", home_dir);
OPENVASD_LIBDIR = strdup(buf);
- sprintf(buf, "%s/lib/openvas/plugins", home_dir);
+ snprintf(buf, 4096, "%s/lib/openvas/plugins", home_dir);
OPENVASD_PLUGINS = strdup(buf);
- sprintf(buf, "%s/lib/openvas/reports", home_dir);
+ snprintf(buf, 4096, "%s/lib/openvas/reports", home_dir);
OPENVASD_REPORTS = strdup(buf);
- sprintf(buf, "%s/logs", OPENVASD_STATEDIR);
+ snprintf(buf, 4096, "%s/logs", OPENVASD_STATEDIR);
OPENVASD_LOGS = strdup(buf);
- sprintf(buf, "%s/users", OPENVASD_STATEDIR);
+ snprintf(buf, 4096, "%s/users", OPENVASD_STATEDIR);
OPENVASD_LOGINS = strdup(buf);
- sprintf(buf, "%s/jobs", OPENVASD_STATEDIR);
+ snprintf(buf, 4096, "%s/jobs", OPENVASD_STATEDIR);
OPENVASD_JOBS = strdup(buf);
- sprintf(buf, "%s/openvas/openvasd.conf", OPENVASD_CONFDIR);
+ snprintf(buf, 4096, "%s/openvas/openvasd.conf", OPENVASD_CONFDIR);
OPENVASD_CONF = strdup(buf);
- sprintf(buf, "%s/-datapool", OPENVASD_STATEDIR);
+ snprintf(buf, 4096, "%s/-datapool", OPENVASD_STATEDIR);
OPENVASD_DATAPOOL = strdup(buf);
- sprintf(buf, "%s/openvasd.rules", OPENVASD_DATADIR);
+ snprintf(buf, 4096, "%s/openvasd.rules", OPENVASD_DATADIR);
OPENVASD_RULES = strdup(buf);
- sprintf(buf, "%s/openvasd.users", OPENVASD_DATADIR);
+ snprintf(buf, 4096, "%s/openvasd.users", OPENVASD_DATADIR);
OPENVASD_USERS = strdup(buf);
- sprintf(buf, "%s/openvasd.user-pwds", OPENVASD_DATADIR);
+ snprintf(buf, 4096, "%s/openvasd.user-pwds", OPENVASD_DATADIR);
OPENVASD_USERPWDS = strdup(buf);
- sprintf(buf, "%s/openvasd.private-keys", OPENVASD_DATADIR);
+ snprintf(buf, 4096, "%s/openvasd.private-keys", OPENVASD_DATADIR);
OPENVASD_KEYFILE = strdup(buf);
- sprintf(buf, "%s/openvasd.logpipe", OPENVASD_DATADIR);
+ snprintf(buf, 4096, "%s/openvasd.logpipe", OPENVASD_DATADIR);
OPENVASD_LOGPIPE = strdup(buf);
- sprintf(buf, "%s/openvasd.messages", OPENVASD_LOGS);
+ snprintf(buf, 4096, "%s/openvasd.messages", OPENVASD_LOGS);
OPENVASD_MESSAGES = strdup(buf);
- sprintf(buf, "%s/openvasd.dump", OPENVASD_LOGS);
+ snprintf(buf, 4096, "%s/openvasd.dump", OPENVASD_LOGS);
OPENVASD_DEBUGMSG = strdup(buf);
- sprintf(buf, "%s/auth/openvasd.user-keys", OPENVASD_DATADIR);
+ snprintf(buf, 4096, "%s/auth/openvasd.user-keys", OPENVASD_DATADIR);
OPENVASD_USERKEYS = strdup(buf);
free(buf);
Modified: trunk/openvas-server/openvasd/oval_plugins.c
===================================================================
--- trunk/openvas-server/openvasd/oval_plugins.c 2008-09-25 09:40:27 UTC
(rev 1433)
+++ trunk/openvas-server/openvasd/oval_plugins.c 2008-09-25 09:55:02 UTC
(rev 1434)
@@ -291,7 +291,7 @@
sc_file = fopen(sc_filename, "w");
if(sc_file == NULL)
{
- sprintf(result_string, "Could not launch ovaldi for OVAL definition %s:
Could not create SC file.\n\n", basename);
+ snprintf(result_string, 256, "Could not launch ovaldi for OVAL definition
%s: Could not create SC file.\n\n", basename);
post_note(g_args, 0, result_string);
efree(&sc_filename);
}
@@ -331,7 +331,7 @@
if(kb_item_get_str(kb, "ssh/login/release") == NULL)
{
log_write("Could not identify release, not collecting package
information.\n");
- sprintf(result_string, "Could not collect remote package information for
OVAL definition %s: Result may be incomplete.\n\n", basename);
+ snprintf(result_string, 256, "Could not collect remote package
information for OVAL definition %s: Result may be incomplete.\n\n", basename);
post_note(g_args, 0, result_string);
}
@@ -441,7 +441,7 @@
if(!g_file_get_contents(results_filename, &filebuffer, &length, NULL))
{
- sprintf(result_string,
+ snprintf(result_string, 256,
"Could not return results for OVAL definition %s: Results file
not found.\n\n",
basename);
post_note(g_args, 0, result_string);
@@ -453,13 +453,13 @@
g_markup_parse_context_parse(context, filebuffer, length, NULL);
g_free(filebuffer);
g_markup_parse_context_free(context);
- sprintf(result_string, "The OVAL definition %s returned the following
result: %s\n\n", basename, result);
+ snprintf(result_string, 256, "The OVAL definition %s returned the
following result: %s\n\n", basename, result);
post_note(g_args, 0, result_string);
}
}
else
{
- sprintf(result_string, "Could not launch ovaldi for OVAL definition %s:
Launch failed. (Is ovaldi in your PATH?)\n\n", basename);
+ snprintf(result_string, 256, "Could not launch ovaldi for OVAL definition
%s: Launch failed. (Is ovaldi in your PATH?)\n\n", basename);
post_note(g_args, 0, result_string);
log_write("Could not launch ovaldi!\n");
}
_______________________________________________
Openvas-commits mailing list
[email protected]
http://lists.wald.intevation.org/mailman/listinfo/openvas-commits
