buffer over flow...

pyama86 · pyama86 · commit a49ab2603a7b · 2020-02-12T19:22:41.000+09:00
diff --git a/pam/pam.c b/pam/pam.c
@@ -125,8 +125,8 @@ int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **ar
     return PAM_ABORT;
   }
 
-  sprintf(user_env, "USER=%s", user);
-  sprintf(from_env, "SSH_CONNECTION=%s", from);
+  snprintf(user_env, MAXBUF, "USER=%s", user);
+  snprintf(from_env, MAXBUF, "SSH_CONNECTION=%s", from);
 
   int ret = popen_cmd(user_env, from_env, "/usr/bin/google-web-oauth", "-only-url", res);
   if (ret != 0) {

Original file line number	Diff line number	Diff line change
`@@ -125,8 +125,8 @@ int pam_sm_authenticate(pam_handle_t pamh, int flags, int argc, const char *ar`
`125`	`125`	`return PAM_ABORT;`
`126`	`126`	`}`
`127`	`127`
`128`		`- sprintf(user_env, "USER=%s", user);`
`129`		`- sprintf(from_env, "SSH_CONNECTION=%s", from);`
	`128`	`+ snprintf(user_env, MAXBUF, "USER=%s", user);`
	`129`	`+ snprintf(from_env, MAXBUF, "SSH_CONNECTION=%s", from);`
`130`	`130`
`131`	`131`	`int ret = popen_cmd(user_env, from_env, "/usr/bin/google-web-oauth", "-only-url", res);`
`132`	`132`	`if (ret != 0) {`