Buffer overflow in dump, as reported from Bugtraq

[dump.git] / dump / itime.c

diff --git a/dump/itime.c b/dump/itime.c
index 441085f1bbcf79eb12d705ae81b927e56845ec81..64d7644c6f8123f4e6ec31e1fb17602b030b015c 100644 (file)
--- a/dump/itime.c
+++ b/dump/itime.c
@@ -2,8 +2,7 @@
  *     Ported to Linux's Second Extended File System as part of the
  *     dump and restore backup suit
  *     Remy Card <card@Linux.EU.Org>, 1994-1997
- *      Stelian Pop <pop@cybercable.fr>, 1999 
- *
+ *     Stelian Pop <pop@cybercable.fr>, 1999-2000
  */
 
 /*-
@@ -40,11 +39,8 @@
  */
 
 #ifndef lint
-#if 0
-static char sccsid[] = "@(#)itime.c    8.1 (Berkeley) 6/5/93";
-#endif
 static const char rcsid[] =
-       "$Id: itime.c,v 1.2 1999/10/11 12:53:22 stelian Exp $";
+       "$Id: itime.c,v 1.10 2000/03/01 10:16:05 stelian Exp $";
 #endif /* not lint */
 
 #include <sys/param.h>
@@ -93,7 +89,7 @@ static        int makedumpdate __P((struct dumpdates *, char *));
 static void readdumptimes __P((FILE *));
 
 void
-initdumptimes()
+initdumptimes(int createdumpdates)
 {
        FILE *df;
 
@@ -103,30 +99,35 @@ initdumptimes()
                            strerror(errno));
                        /* NOTREACHED */
                }
-               /*
-                * Dumpdates does not exist, make an empty one.
-                */
-               msg("WARNING: no file `%s', making an empty one\n", dumpdates);
-               if ((df = fopen(dumpdates, "w")) == NULL) {
-                       quit("cannot create %s: %s\n", dumpdates,
-                           strerror(errno));
-                       /* NOTREACHED */
+               if (createdumpdates) {
+                       /*
+                        * Dumpdates does not exist, make an empty one.
+                        */
+                       msg("WARNING: no file `%s', making an empty one\n", dumpdates);
+                       if ((df = fopen(dumpdates, "w")) == NULL) {
+                               quit("cannot create %s: %s\n", dumpdates,
+                               strerror(errno));
+                               /* NOTREACHED */
+                       }
+                       (void) fclose(df);
+                       if ((df = fopen(dumpdates, "r")) == NULL) {
+                               quit("cannot read %s even after creating it: %s\n",
+                               dumpdates, strerror(errno));
+                               /* NOTREACHED */
+                       }
                }
+               else
+                       msg("WARNING: no file `%s'\n", dumpdates);
+       }
+       if (df != NULL) {
+               (void) flock(fileno(df), LOCK_SH);
+               readdumptimes(df);
                (void) fclose(df);
-               if ((df = fopen(dumpdates, "r")) == NULL) {
-                       quit("cannot read %s even after creating it: %s\n",
-                           dumpdates, strerror(errno));
-                       /* NOTREACHED */
-               }
        }
-       (void) flock(fileno(df), LOCK_SH);
-       readdumptimes(df);
-       (void) fclose(df);
 }
 
 static void
-readdumptimes(df)
-       FILE *df;
+readdumptimes(FILE *df)
 {
        register int i;
        register struct dumptime *dtwalk;
@@ -153,7 +154,7 @@ readdumptimes(df)
 }
 
 void
-getdumptime()
+getdumptime(int createdumpdates)
 {
        register struct dumpdates *ddp;
        register int i;
@@ -167,7 +168,15 @@ getdumptime()
        spcl.c_ddate = 0;
        lastlevel = '0';
 
-       initdumptimes();
+       /* If this is a level 0 dump, and we're not updating 
+          dumpdates, there's no point in trying to read
+          dumpdates.  It may not exist yet, or may not be mounted.  For
+          incrementals, we *must* read dumpdates (fail if it's not there!) */
+       if ( (level == lastlevel) && !createdumpdates)
+               return;
+       initdumptimes(createdumpdates);
+       if (ddatev == NULL)
+               return;
        /*
         *      Go find the entry with the same name for a lower increment
         *      and older date
@@ -189,7 +198,7 @@ getdumptime()
 }
 
 void
-putdumptime()
+putdumptime(void)
 {
        FILE *df;
        register struct dumpdates *dtwalk;
@@ -250,12 +259,10 @@ putdumptime()
 }
 
 static void
-dumprecout(file, what)
-       FILE *file;
-       struct dumpdates *what;
+dumprecout(FILE *file, struct dumpdates *what)
 {
 
-       if (fprintf(file, DUMPOUTFMT,
+       if (fprintf(file, "%s %c %s",
                    what->dd_name,
                    what->dd_level,
                    ctime(&what->dd_ddate)) < 0)
@@ -265,14 +272,12 @@ dumprecout(file, what)
 int    recno;
 
 static int
-getrecord(df, ddatep)
-       FILE *df;
-       struct dumpdates *ddatep;
+getrecord(FILE *df, struct dumpdates *ddatep)
 {
        char tbuf[BUFSIZ];
 
        recno = 0;
-       if ( (fgets(tbuf, sizeof (tbuf), df)) != tbuf)
+       if (fgets(tbuf, sizeof (tbuf), df) == NULL)
                return(-1);
        recno++;
        if (makedumpdate(ddatep, tbuf) < 0)
@@ -287,14 +292,29 @@ getrecord(df, ddatep)
 }
 
 static int
-makedumpdate(ddp, tbuf)
-       struct dumpdates *ddp;
-       char *tbuf;
+makedumpdate(struct dumpdates *ddp, char *tbuf)
 {
-       char un_buf[128];
+       char *tok;
+       
+       /* device name */
+       if ( NULL == (tok = strsep( &tbuf, " ")) )
+               return(-1);
+       if ( strlen(tok) >  MAXPATHLEN )
+               return(-1);
+       strcpy(ddp->dd_name, tok);
+
+       /* eat whitespace */
+       for( ; *tbuf == ' ' ; tbuf++);
+
+       /* dump level */
+       ddp->dd_level = *tbuf;
+       ++tbuf;
+
+       /* eat whitespace */
+       for( ; *tbuf == ' ' ; tbuf++);
 
-       (void) sscanf(tbuf, DUMPINFMT, ddp->dd_name, &ddp->dd_level, un_buf);
-       ddp->dd_ddate = unctime(un_buf);
+       /* dump date */
+       ddp->dd_ddate = unctime(tbuf);
        if (ddp->dd_ddate < 0)
                return(-1);
        return(0);