From 8d41bc24c51018a25eac49b3403cbb276713e1ad Mon Sep 17 00:00:00 2001 From: Russ Allbery Date: Tue, 6 Apr 2010 16:31:37 -0700 Subject: [PATCH] Reallocate memory in aklog for the AFS ID string aklog was previously writing the magic AFS ID string into previously alloated memory with sprintf, but the variable in question was only as long as the username, so this code could overwrite memory and lead to heap corruption. Free previously allocated memory and use afs_asprintf to format the AFS ID string instead. Change-Id: I7649864817340764c39c176606a9a543c10983c9 Reviewed-on: http://gerrit.openafs.org/1706 Tested-by: Russ Allbery Reviewed-by: Simon Wilkinson Reviewed-by: Derrick Brashear Tested-by: Derrick Brashear --- src/aklog/aklog.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/aklog/aklog.c b/src/aklog/aklog.c index cd994c6e39..43cd8465dc 100644 --- a/src/aklog/aklog.c +++ b/src/aklog/aklog.c @@ -1100,7 +1100,12 @@ auth_to_cell(krb5_context context, char *cell, char *realm, char **linkedcell) */ if ((status == 0) && (viceId != ANONYMOUSID)) { - sprintf(username, "AFS ID %d", (int) viceId); + free(username); + if (afs_asprintf(&username, "AFS ID %d", (int) viceId) < 0) { + status = ENOMEM; + username = NULL; + goto out; + } } }