[Fedora-directory-commits] adminserver/lib/ldaputil certmap.c, 1.4, 1.5 init.c, 1.4, 1.5

[Richard Allen Megginson (rmeggins)]

Author: rmeggins

Update of /cvs/dirsec/adminserver/lib/ldaputil
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv28761/adminserver/lib/ldaputil

Modified Files:
	certmap.c init.c 
Log Message:
Bug(s) fixed: 186280
Bug Description: adminserver: Close potential security vulnerabilities 
in CGI code
Reviewed by: Rob, Pete, Nathan, Noriko (Thanks!)
Fix Description: Most of this just involves making sure that we use 
PR_snprintf/PL_strncpyz/PL_strcatn where able, or just making sure we 
use snprintf/strncpy/strncat correctly and null terminate the buffers.  
I also got rid of some dead code, unused variables, and the like.  There 
are a few cases that are more complex that I have specified below.  In 
some cases I had to change the function signature to add a size 
parameter in cases where the function was copying to a given char * and 
the size was assumed (in most cases this was safe but it's still dangerous).
Platforms tested: Fedora Core 5
Flag Day: no
Doc impact: no



Index: certmap.c
===================================================================
RCS file: /cvs/dirsec/adminserver/lib/ldaputil/certmap.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- certmap.c	18 Aug 2005 19:18:50 -0000	1.4
+++ certmap.c	31 Mar 2006 22:58:23 -0000	1.5
@@ -1096,7 +1096,7 @@
 		    vallen = ava->value.len - lenLen;
 
 		    rv = CERT_RFC1485_EscapeAndQuote(buf,
-						    BIG_LINE,
+						    sizeof(buf),
 						    (char*) ava->value.data + lenLen,
 						    vallen);
 
@@ -1195,12 +1195,12 @@
 		const char *tagName = certmap_secoid_to_name(tag);
 
 		if (PresentInComps(certmap_info->dncomps, tag)) {
-		    rv = AddToLdapDN(ldapdn, BIG_LINE, &dnlen, tagName, ava);
+		    rv = AddToLdapDN(ldapdn, sizeof(ldapdn), &dnlen, tagName, ava);
 		    if (rv != LDAPU_SUCCESS) return rv;
 		}
 
 		if (PresentInComps(certmap_info->filtercomps, tag)) {
-		    rv = AddToFilter(filter, BIG_LINE, &flen, tagName, ava);
+		    rv = AddToFilter(filter, sizeof(filter), &flen, tagName, ava);
 		    if (rv != LDAPU_SUCCESS) return rv;
 		    numfavas++;
 		}


Index: init.c
===================================================================
RCS file: /cvs/dirsec/adminserver/lib/ldaputil/init.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- init.c	18 Aug 2005 19:18:50 -0000	1.4
+++ init.c	31 Mar 2006 22:58:23 -0000	1.5
@@ -66,7 +66,7 @@
             if(is_lib) {
 		char path[1024];
 
-		sprintf(path, "%s%c%s", dir, FILE_PATHSEP, libname);
+		PR_snprintf(path, sizeof(path), "%s%c%s", dir, FILE_PATHSEP, libname);
 		lib = PR_LoadLibrary(path);
 		if (!lib) rv = LDAPU_ERR_UNABLE_TO_LOAD_PLUGIN;
 	    }
@@ -99,7 +99,7 @@
 
 	if (serv_root && *serv_root) {
 	    /* Load common libraries */
-	    sprintf(dir, "%s%clib%c%s", serv_root, FILE_PATHSEP,
+	    PR_snprintf(dir, sizeof(dir), "%s%clib%c%s", serv_root, FILE_PATHSEP,
 		    FILE_PATHSEP, "common");
 	    rv = load_server_libs(dir);
 
@@ -107,7 +107,7 @@
 
 	    if (serv_type && *serv_type) {
 		/* Load server type specific libraries */
-		sprintf(dir, "%s%clib%c%s", serv_root, FILE_PATHSEP,
+		PR_snprintf(dir, sizeof(dir), "%s%clib%c%s", serv_root, FILE_PATHSEP,
 			FILE_PATHSEP, serv_type);
 		rv = load_server_libs(dir);
 
@@ -115,7 +115,7 @@
 
 		if (serv_id && *serv_id) {
 		    /* Load server instance specific libraries */
-		    sprintf(dir, "%s%clib%c%s", serv_root, FILE_PATHSEP,
+		    PR_snprintf(dir, sizeof(dir), "%s%clib%c%s", serv_root, FILE_PATHSEP,
 			    FILE_PATHSEP, serv_id);
 		    rv = load_server_libs(dir);