Buffer overflow in dump, as reported from Bugtraq

[dump.git] / dump / itime.c

diff --git a/dump/itime.c b/dump/itime.c
index 2529865cb06da1e02d5a52aa035c75ada3bbf621..64d7644c6f8123f4e6ec31e1fb17602b030b015c 100644 (file)
--- a/dump/itime.c
+++ b/dump/itime.c
@@ -2,8 +2,7 @@
  *     Ported to Linux's Second Extended File System as part of the
  *     dump and restore backup suit
  *     Remy Card <card@Linux.EU.Org>, 1994-1997
- *      Stelian Pop <pop@cybercable.fr>, 1999 
- *
+ *     Stelian Pop <pop@cybercable.fr>, 1999-2000
  */
 
 /*-
@@ -37,10 +36,13 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- *
- * $Id: itime.c,v 1.5 1999/10/11 13:31:11 stelian Exp $
  */
 
+#ifndef lint
+static const char rcsid[] =
+       "$Id: itime.c,v 1.10 2000/03/01 10:16:05 stelian Exp $";
+#endif /* not lint */
+
 #include <sys/param.h>
 #include <sys/time.h>
 #ifdef __linux__
@@ -166,10 +168,11 @@ getdumptime(int createdumpdates)
        spcl.c_ddate = 0;
        lastlevel = '0';
 
-       /* if we're not going to update dumpdates, there's no point in reading
-          it, particularly since /var might not be mounted... wait until here
-          to benefit from the initialization of variables needed by parent */
-       if (!uflag && level == lastlevel)
+       /* If this is a level 0 dump, and we're not updating 
+          dumpdates, there's no point in trying to read
+          dumpdates.  It may not exist yet, or may not be mounted.  For
+          incrementals, we *must* read dumpdates (fail if it's not there!) */
+       if ( (level == lastlevel) && !createdumpdates)
                return;
        initdumptimes(createdumpdates);
        if (ddatev == NULL)
@@ -259,7 +262,7 @@ static void
 dumprecout(FILE *file, struct dumpdates *what)
 {
 
-       if (fprintf(file, DUMPOUTFMT,
+       if (fprintf(file, "%s %c %s",
                    what->dd_name,
                    what->dd_level,
                    ctime(&what->dd_ddate)) < 0)
@@ -291,10 +294,27 @@ getrecord(FILE *df, struct dumpdates *ddatep)
 static int
 makedumpdate(struct dumpdates *ddp, char *tbuf)
 {
-       char un_buf[BUFSIZ];
+       char *tok;
+       
+       /* device name */
+       if ( NULL == (tok = strsep( &tbuf, " ")) )
+               return(-1);
+       if ( strlen(tok) >  MAXPATHLEN )
+               return(-1);
+       strcpy(ddp->dd_name, tok);
+
+       /* eat whitespace */
+       for( ; *tbuf == ' ' ; tbuf++);
+
+       /* dump level */
+       ddp->dd_level = *tbuf;
+       ++tbuf;
+
+       /* eat whitespace */
+       for( ; *tbuf == ' ' ; tbuf++);
 
-       (void) sscanf(tbuf, DUMPINFMT, ddp->dd_name, &ddp->dd_level, un_buf);
-       ddp->dd_ddate = unctime(un_buf);
+       /* dump date */
+       ddp->dd_ddate = unctime(tbuf);
        if (ddp->dd_ddate < 0)
                return(-1);
        return(0);