From 70e1c5a55ad84d7d3de004fdf7d49835b4fe6a43 Mon Sep 17 00:00:00 2001 From: Jon Trulson Date: Wed, 8 Aug 2012 20:17:17 -0600 Subject: [PATCH] dtaction: Fix unsafe use of sprintf Patch from Robert Tomsick : I believe this fixes vulnerability #3 from CERT CA-1999-11.[1] The other uses of sprintf in DtAction seem to be safe. [1] https://www.cert.org/advisories/CA-1999-11.html --- cde/programs/dtaction/Main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cde/programs/dtaction/Main.c b/cde/programs/dtaction/Main.c index cecdceb3..13f2d24f 100644 --- a/cde/programs/dtaction/Main.c +++ b/cde/programs/dtaction/Main.c @@ -898,8 +898,8 @@ GetUserPrompt( void ) XmString cancelLabel; XmString okLabel; - sprintf(prompt, (GETMESSAGE(1,5, "Enter password for user %s:")), - appArgs.user); + snprintf(prompt, BUFSIZ, (GETMESSAGE(1,5, "Enter password for user %s:")), + appArgs.user); xmString = XmStringCreateLocalized(prompt); xmString2 =XmStringCreateLocalized(GETMESSAGE(1,6, "Action Invoker - Password")); cancelLabel = XmStringCreateLocalized(GETMESSAGE(1,7, "Cancel")); -- 2.25.1