Hello community, here is the log from the commit of package mtr checked in at Tue Jun 3 01:02:24 CEST 2008. -------- --- mtr/mtr.changes 2008-04-14 17:34:47.000000000 +0200 +++ /mounts/work_src_done/STABLE/mtr/mtr.changes 2008-05-27 18:05:37.000000000 +0200 @@ -1,0 +2,6 @@ +Tue May 27 17:46:24 CEST 2008 - lmichnovic@suse.cz + +- fixed more possible overflows because of using sprintf in dns.c + (*-sec_snprintf.patch) [bnc#392458] + +------------------------------------------------------------------- New: ---- mtr-0.73-sec_snprintf.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mtr.spec ++++++ --- /var/tmp/diff_new_pack.J11780/_old 2008-06-03 01:02:13.000000000 +0200 +++ /var/tmp/diff_new_pack.J11780/_new 2008-06-03 01:02:13.000000000 +0200 @@ -15,7 +15,7 @@ BuildRequires: gtk1-compat-devel gtk2-devel ncurses-devel update-desktop-files xorg-x11-devel Summary: Ping and Traceroute Network Diagnostic Tool Version: 0.73 -Release: 1 +Release: 14 Group: Productivity/Networking/Diagnostic License: GPL v2 or later Url: http://www.BitWizard.nl/mtr @@ -24,6 +24,7 @@ Patch1: %{name}-%{version}-manmtr.patch Patch2: %{name}-%{version}-manxmtr.patch Patch3: %{name}-%{version}-nonvoid.patch +Patch4: %{name}-%{version}-sec_snprintf.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build Icon: %{name}.gif PreReq: permissions @@ -90,6 +91,7 @@ %patch1 %patch2 %patch3 +%patch4 %build %{?suse_update_config:%{suse_update_config}} @@ -148,6 +150,9 @@ %verify_permissions -e /usr/sbin/mtr %changelog +* Tue May 27 2008 lmichnovic@suse.cz +- fixed more possible overflows because of using sprintf in dns.c + (*-sec_snprintf.patch) [bnc#392458] * Mon Apr 14 2008 lmichnovic@suse.cz - update to version 0.73 * Fix signed/unsigned bug in IPV6 part improved random packet ++++++ mtr-0.73-sec_snprintf.patch ++++++ --- dns.c +++ dns.c @@ -877,14 +877,14 @@ if (type == T_A) { dorequest(rp->hostname,type,rp->id); if (debug) { - sprintf(tempstring,"Resolver: Sent reverse authentication request for \"%s\".", + snprintf(tempstring, sizeof(tempstring),"Resolver: Sent reverse authentication request for \"%s\".", rp->hostname); restell(tempstring); } } else if (type == T_PTR) { switch ( af ) { case AF_INET: - sprintf(tempstring,"%u.%u.%u.%u.in-addr.arpa", + snprintf(tempstring, sizeof(tempstring),"%u.%u.%u.%u.in-addr.arpa", ((byte *)&rp->ip)[3], ((byte *)&rp->ip)[2], ((byte *)&rp->ip)[1], @@ -898,7 +898,7 @@ } dorequest(tempstring,type,rp->id); if (debug) { - sprintf(tempstring,"Resolver: Sent domain lookup request for \"%s\".", + snprintf(tempstring, sizeof(tempstring),"Resolver: Sent domain lookup request for \"%s\".", strlongip( &(rp->ip) )); restell(tempstring); } @@ -934,7 +934,7 @@ rp->expiretime = sweeptime + (double)ttl; untieresolve(rp); if (debug) { - sprintf(tempstring,"Resolver: Lookup successful: %s\n",rp->hostname); + snprintf(tempstring, sizeof(tempstring),"Resolver: Lookup successful: %s\n",rp->hostname); restell(tempstring); } } @@ -991,7 +991,7 @@ case NOERROR: if (hp->ancount) { if (debug) { - sprintf(tempstring,"Resolver: Received nameserver reply. (qd:%u an:%u ns:%u ar:%u)", + snprintf(tempstring, sizeof(tempstring),"Resolver: Received nameserver reply. (qd:%u an:%u ns:%u ar:%u)", hp->qdcount,hp->ancount,hp->nscount,hp->arcount); restell(tempstring); } @@ -1031,14 +1031,14 @@ namestring[strlen(stackstring)] = '\0'; if (strcasecmp(stackstring,namestring)) { if (debug) { - sprintf(tempstring,"Resolver: Unknown query packet dropped. (\"%s\" does not match \"%s\")", + snprintf(tempstring, sizeof(tempstring),"Resolver: Unknown query packet dropped. (\"%s\" does not match \"%s\")", stackstring,namestring); restell(tempstring); } return; } if (debug) { - sprintf(tempstring,"Resolver: Queried domain name: \"%s\"",namestring); + snprintf(tempstring, sizeof(tempstring),"Resolver: Queried domain name: \"%s\"",namestring); restell(tempstring); } c+= r; @@ -1049,7 +1049,7 @@ qdatatype = sucknetword(c); qclass = sucknetword(c); if (qclass != C_IN) { - sprintf(tempstring,"Resolver error: Received unsupported query class: %u (%s)", + snprintf(tempstring, sizeof(tempstring), "Resolver error: Received unsupported query class: %u (%s)", qclass,qclass < ClasstypeCount ? classtypes[qclass] : classtypes[ClasstypeCount]); restell(tempstring); @@ -1063,7 +1063,7 @@ } break; default: - sprintf(tempstring,"Resolver error: Received unimplemented query type: %u (%s)", + snprintf(tempstring, sizeof(tempstring),"Resolver error: Received unimplemented query type: %u (%s)", qdatatype,qdatatype < ResourcetypeCount ? resourcetypes[qdatatype] : resourcetypes[ResourcetypeCount]); restell(tempstring); @@ -1085,7 +1085,7 @@ else usefulanswer = 1; if (debug) { - sprintf(tempstring,"Resolver: answered domain query: \"%s\"",namestring); + snprintf(tempstring, sizeof(tempstring),"Resolver: answered domain query: \"%s\"",namestring); restell(tempstring); } c+= r; @@ -1098,10 +1098,10 @@ ttl = sucknetlong(c); rdatalength = sucknetword(c); if (class != qclass) { - sprintf(tempstring,"query class: %u (%s)",qclass,qclass < ClasstypeCount ? + snprintf(tempstring, sizeof(tempstring),"query class: %u (%s)",qclass,qclass < ClasstypeCount ? classtypes[qclass] : classtypes[ClasstypeCount]); restell(tempstring); - sprintf(tempstring,"rr class: %u (%s)",class,class < ClasstypeCount ? + snprintf(tempstring, sizeof(tempstring),"rr class: %u (%s)",class,class < ClasstypeCount ? classtypes[class] : classtypes[ClasstypeCount]); restell(tempstring); restell("Resolver error: Answered class does not match queried class."); @@ -1117,20 +1117,20 @@ } if (datatype == qdatatype || datatype == T_CNAME) { if (debug) { - sprintf(tempstring,"Resolver: TTL: %s",strtdiff(sendstring,ttl)); + snprintf(tempstring, sizeof(tempstring), "Resolver: TTL: %s",strtdiff(sendstring,ttl)); restell(tempstring); } if (usefulanswer) switch (datatype) { case T_A: if (rdatalength != 4) { - sprintf(tempstring,"Resolver error: Unsupported rdata format for \"A\" type. (%u bytes)", + snprintf(tempstring, sizeof(tempstring),"Resolver error: Unsupported rdata format for \"A\" type. (%u bytes)", rdatalength); restell(tempstring); return; } if ( addrcmp( (void *) &(rp->ip), (void *) c, af ) == 0 ) { - sprintf(tempstring,"Resolver: Reverse authentication failed: %s != ", + snprintf(tempstring, sizeof(tempstring),"Resolver: Reverse authentication failed: %s != ", strlongip( &(rp->ip) )); addrcpy( (void *) &alignedip, (void *) c, af ); strcat(tempstring,strlongip( &alignedip )); @@ -1138,7 +1138,7 @@ res_hostipmismatch++; failrp(rp); } else { - sprintf(tempstring,"Resolver: Reverse authentication complete: %s == \"%s\".", + snprintf(tempstring, sizeof(tempstring),"Resolver: Reverse authentication complete: %s == \"%s\".", strlongip( &(rp->ip) ),nonull(rp->hostname)); restell(tempstring); res_reversesuccess++; @@ -1155,7 +1155,7 @@ return; } if (debug) { - sprintf(tempstring,"Resolver: Answered domain: \"%s\"",namestring); + snprintf(tempstring, sizeof(tempstring),"Resolver: Answered domain: \"%s\"",namestring); restell(tempstring); } if (r > HostnameLength) { @@ -1180,14 +1180,14 @@ } break; default: - sprintf(tempstring,"Resolver error: Received unimplemented data type: %u (%s)", + snprintf(tempstring, sizeof(tempstring),"Resolver error: Received unimplemented data type: %u (%s)", datatype,datatype < ResourcetypeCount ? resourcetypes[datatype] : resourcetypes[ResourcetypeCount]); restell(tempstring); } } else { if (debug) { - sprintf(tempstring,"Resolver: Ignoring resource type %u. (%s)", + snprintf(tempstring, sizeof(tempstring),"Resolver: Ignoring resource type %u. (%s)", datatype,datatype < ResourcetypeCount ? resourcetypes[datatype] : resourcetypes[ResourcetypeCount]); restell(tempstring); @@ -1205,7 +1205,7 @@ failrp(rp); break; default: - sprintf(tempstring,"Resolver: Received error response %u. (%s)", + snprintf(tempstring, sizeof(tempstring),"Resolver: Received error response %u. (%s)", getheader_rcode(hp),getheader_rcode(hp) < ResponsecodeCount ? responsecodes[getheader_rcode(hp)] : responsecodes[ResponsecodeCount]); restell(tempstring); @@ -1236,13 +1236,13 @@ (void *) &(from4->sin_addr), AF_INET ) == 0 ) break; if (i == _res.nscount) { - sprintf(tempstring,"Resolver error: Received reply from unknown source: %s", + snprintf(tempstring, sizeof(tempstring), "Resolver error: Received reply from unknown source: %s", inet_ntoa(from4->sin_addr )); restell(tempstring); } else parserespacket((byte *)resrecvbuf,r); } else { - sprintf(tempstring,"Resolver: Socket error: %s",strerror(errno)); + snprintf(tempstring, sizeof(tempstring),"Resolver: Socket error: %s",strerror(errno)); restell(tempstring); } } @@ -1271,7 +1271,7 @@ case STATE_FINISHED: /* TTL has expired */ case STATE_FAILED: /* Fake TTL has expired */ if (debug) { - sprintf(tempstring,"Resolver: Cache record for \"%s\" (%s) has expired. (state: %u) Marked for expire at: %g, time: %g.", + snprintf(tempstring, sizeof(tempstring),"Resolver: Cache record for \"%s\" (%s) has expired. (state: %u) Marked for expire at: %g, time: %g.", nonull(rp->hostname), strlongip( &(rp->ip) ), rp->state, rp->expiretime, sweeptime); restell(tempstring); @@ -1315,14 +1315,14 @@ if ((rp->state == STATE_FINISHED) || (rp->state == STATE_FAILED)) { if ((rp->state == STATE_FINISHED) && (rp->hostname)) { if (debug) { - sprintf(tempstring,"Resolver: Used cached record: %s == \"%s\".\n", + snprintf(tempstring, sizeof(tempstring),"Resolver: Used cached record: %s == \"%s\".\n", strlongip(ip),rp->hostname); restell(tempstring); } return rp->hostname; } else { if (debug) { - sprintf(tempstring,"Resolver: Used failed record: %s == ???\n", + snprintf(tempstring, sizeof(tempstring),"Resolver: Used failed record: %s == ???\n", strlongip(ip)); restell(tempstring); } ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org