There's multiple instances of buffer overflows in this package via improper use of scanf(3)
.
char printer_id[BUFSIZE], backend_name[BUFSIZE], file_path[BUFSIZE];
scanf("%s%s%s", file_path, printer_id, backend_name);
char printer_id[BUFSIZE];
char backend_name[BUFSIZE];
scanf("%s%s", printer_id, backend_name);
char obj_path[CPDB_BSIZE];
/* ... */
if ((file = fopen(path, "r")) == NULL)
/* ... */
if (fscanf(file, "%s", obj_path) == 0)
Summary
There's multiple instances of buffer overflows in this package via improper use of
scanf(3)
.Details
cpdb-libs/tools/cpdb-text-frontend.c
Line 362 in 85555fb
cpdb-libs/tools/cpdb-text-frontend.c
Line 453 in 85555fb
cpdb-libs/cpdb/cpdb-frontend.c
Line 372 in 85555fb
%s
does not place bounds on the allowed input sizes.