proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-07 20:19:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

lib/printf: disable %n specifier

Browse Source 
We don't use `%n` anywhere, so the only purpose it serves is enabling
exploits.

(I thought about this initially when adding printfrr, but I wasn't sure
we don't use `%n` anywhere, and thought I'll check later, and then just
forgot it...)

Signed-off-by: David Lamparter <equinox@diac24.net>
This commit is contained in:
David Lamparter 2021-02-01 17:50:01 +01:00
parent 6968b038eb
commit 738cca0ab4
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/printf/printf-pos.c
View File

@ -384,6 +384,7 @@ reswitch: switch (ch) {
goto error; goto error;
break; break;
#endif /* !NO_FLOATING_POINT */ #endif /* !NO_FLOATING_POINT */
#ifdef DANGEROUS_PERCENT_N
case 'n': case 'n':
if (flags & INTMAXT) if (flags & INTMAXT)
error = addtype(&types, TP_INTMAXT); error = addtype(&types, TP_INTMAXT);
@ -404,6 +405,7 @@ reswitch: switch (ch) {
if (error) if (error)
goto error; goto error;
continue; /* no output */ continue; /* no output */
#endif
case 'O': case 'O':
flags |= LONGINT; flags |= LONGINT;
/*FALLTHROUGH*/ /*FALLTHROUGH*/
@ -576,6 +578,7 @@ reswitch: switch (ch) {
goto error; goto error;
break; break;
#endif /* !NO_FLOATING_POINT */ #endif /* !NO_FLOATING_POINT */
#ifdef DANGEROUS_PERCENT_N
case 'n': case 'n':
if (flags & INTMAXT) if (flags & INTMAXT)
error = addtype(&types, TP_INTMAXT); error = addtype(&types, TP_INTMAXT);
@ -596,6 +599,7 @@ reswitch: switch (ch) {
if (error) if (error)
goto error; goto error;
continue; /* no output */ continue; /* no output */
#endif
case 'O': case 'O':
flags |= LONGINT; flags |= LONGINT;
/*FALLTHROUGH*/ /*FALLTHROUGH*/

6
lib/printf/vfprintf.c
View File

@ -503,6 +503,11 @@ reswitch: switch (ch) {
size = (prec >= 0) ? strnlen(cp, prec) : strlen(cp); size = (prec >= 0) ? strnlen(cp, prec) : strlen(cp);
sign = '\0'; sign = '\0';
break; break;
#ifdef DANGEROUS_PERCENT_N
/* FRR does not use %n in printf formats. This is just left
* here in case someone tries to use %n and starts debugging
* why the f* it doesn't work
*/
case 'n': case 'n':
/* /*
* Assignment-like behavior is specified if the * Assignment-like behavior is specified if the
@ -526,6 +531,7 @@ reswitch: switch (ch) {
else else
*GETARG(int *) = ret; *GETARG(int *) = ret;
continue; /* no output */ continue; /* no output */
#endif
case 'O': case 'O':
flags |= LONGINT; flags |= LONGINT;
/*FALLTHROUGH*/ /*FALLTHROUGH*/