Changeset 563

Timestamp:

07/11/08 23:20:50 (5 months ago)

Author:

athomas

Message:

Fix for security vulnerability reported by Nico Golde.

Files:

• op/trunk/main.c (modified) (4 diffs)

op/trunk/main.c

@@ -798 +798 @@
-        if (getenv("DISPLAY") != NULL && (cp = FindOpt(cmd, "xauth")) != NULL) {
-        struct passwd *currentpw;
-xauth[MAXSTRLEN], cxauth[MAXSTRLEN]
+*xauth, *cxauth
-        int status;
-        uid_t uid;
@@ -814 +814 @@
-                if ((display = strchr(getenv("DISPLAY"), ':')) == NULL)
-                        fatal(1, "Could not extract X server from $DISPLAY '%s'", getenv("DISPLAY"));
+                xauth = (char*)malloc(strlen(pw->pw_dir) + strlen("/.Xauthority") + 1);
-                strcpy(xauth, pw->pw_dir);
-                strcat(xauth, "/.Xauthority");
@@ -821 +822 @@
-                /* Now that we know the target user, we can copy the xauth cookies */
-                if (getenv("XAUTHORITY") != NULL) {
-strcpy(cxauth, 
+cxauth = strdup(
-                } else {
+                        cxauth = (char*)malloc(strlen(currentpw->pw_dir) +
+                                                                   strlen("/.Xauthority") + 1);
-                        strcpy(cxauth, currentpw->pw_dir);
-                        strcat(cxauth, "/.Xauthority");
@@ -1209 +1212 @@
-                                                                tmp = str_replace(cmd->args[i],
-                                                                        np - cmd->args[i] - 1, cp - np + 1, argv[val]);
-1
+(strlen(tmp) - strlen(cmd->args[i]));
-                                                                np = cp;
-                                                                cmd->args[i] = tmp;