search for: cd_init

...a fixed size buffer resulting in a complete compromise of system security on machines with XMCD installed suid root. The cddb_init() function reads in the environment variable XMCD_CDDBPATH, and parses out path names from it, dynamically allocating memory for each pathname as it is parsed. The cd_init() functions, which calls cddb_init(), then uses the structure with the dynamically allocated path string and copies it into a fixed length buffer with: sprintf(str, " %s", pathp->path); The str variable is defined in cd_init() as char str[FILE_PATH_SZ + 2]. Rob McMillan and Georgia...

This is to announce that XMCD 2.1 patchlevel 0 has been released which fixes all of the issues previously raised by David Meltzer. It also contains a number of other minor feature and functionality enhancements. The new version may be obtained via the xmcd web page at: http://sunsite.unc.edu/~cddb/xmcd/ Users of xmcd with older versions are encouraged to upgrade. -Ti -- \\ // XMCD - Motif CD

...fixed size buffer resulting in a complete compromise of system security on machines with XMCD installed suid root. The cddb_init() function reads in the environment variable XMCD_CDDBPATH, and parses out path names from it, dynamically allocating memory for each pathname as it is parsed. The cd_init() functions, which calls cddb_init(), then uses the structure with the dynamically allocated path string and copies it into a fixed length buffer with: sprintf(str, " %s", pathp->path); The str variable is defined in cd_init() as char str[FILE_PATH_SZ + 2]. Rob McMillan and Georgi...