From b3211a85894b06bd3060a1e2b3b18c3fba536da9 Mon Sep 17 00:00:00 2001 From: Ben Lindstrom Date: Sat, 10 Feb 2001 22:33:19 +0000 Subject: - markus@cvs.openbsd.org 2001/02/08 21:58:28 [channels.c] nuke sprintf, ok deraadt@ --- ChangeLog | 11 +++++++++-- channels.c | 10 ++++++---- 2 files changed, 15 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index be7548848..af5eed098 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,7 +46,14 @@ - markus@cvs.openbsd.org 2001/02/09 13:38:07 [auth-options.c] reset options if no option is given; from han.holl@prismant.nl - instead of '0' (from the OpenBSD tree) + - markus@cvs.openbsd.org 2001/02/08 21:58:28 + [channels.c] + nuke sprintf, ok deraadt@ + - markus@cvs.openbsd.org 2001/02/08 21:58:28 + [channels.c] + nuke sprintf, ok deraadt@ + - (bal) fixed sftp-client.c. Return 'status' instead of '0' + (from the OpenBSD tree) - (bal) Synced ssh.1 and sshd.8 w/ OpenBSD 20010210 @@ -3831,4 +3838,4 @@ - Wrote replacements for strlcpy and mkdtemp - Released 1.0pre1 -$Id: ChangeLog,v 1.725 2001/02/10 22:27:19 mouring Exp $ +$Id: ChangeLog,v 1.726 2001/02/10 22:33:19 mouring Exp $ diff --git a/channels.c b/channels.c index 354160e8f..a079fc24d 100644 --- a/channels.c +++ b/channels.c @@ -40,7 +40,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: channels.c,v 1.89 2001/02/04 15:32:23 stevesk Exp $"); +RCSID("$OpenBSD: channels.c,v 1.90 2001/02/08 21:58:28 markus Exp $"); #include #include @@ -2227,7 +2227,7 @@ x11_request_forwarding_with_spoofing(int client_session_id, const char *proto, const char *data) { u_int data_len = (u_int) strlen(data) / 2; - u_int i, value; + u_int i, value, len; char *new_data; int screen_number; const char *cp; @@ -2265,9 +2265,11 @@ x11_request_forwarding_with_spoofing(int client_session_id, x11_fake_data_len = data_len; /* Convert the fake data into hex. */ - new_data = xmalloc(2 * data_len + 1); + len = 2 * data_len + 1; + new_data = xmalloc(len); for (i = 0; i < data_len; i++) - sprintf(new_data + 2 * i, "%02x", (u_char) x11_fake_data[i]); + snprintf(new_data + 2 * i, len - 2 * i, + "%02x", (u_char) x11_fake_data[i]); /* Send the request packet. */ if (compat20) { -- cgit v1.2.3