Buffer overflow in dump, as reported from Bugtraq

[dump.git] / dump / itime.c

diff --git a/dump/itime.c b/dump/itime.c
index a1b66f9a33ddf4194dd90ee933d2c59d3d0d8c8a..64d7644c6f8123f4e6ec31e1fb17602b030b015c 100644 (file)
--- a/dump/itime.c
+++ b/dump/itime.c
@@ -2,8 +2,7 @@
  *     Ported to Linux's Second Extended File System as part of the
  *     dump and restore backup suit
  *     Remy Card <card@Linux.EU.Org>, 1994-1997
- *      Stelian Pop <pop@cybercable.fr>, 1999 
- *
+ *     Stelian Pop <pop@cybercable.fr>, 1999-2000
  */
 
 /*-
@@ -40,11 +39,8 @@
  */
 
 #ifndef lint
-#if 0
-static char sccsid[] = "@(#)itime.c    8.1 (Berkeley) 6/5/93";
-#endif
 static const char rcsid[] =
-       "$Id: itime.c,v 1.3 1999/10/11 12:59:18 stelian Exp $";
+       "$Id: itime.c,v 1.10 2000/03/01 10:16:05 stelian Exp $";
 #endif /* not lint */
 
 #include <sys/param.h>
@@ -93,7 +89,7 @@ static        int makedumpdate __P((struct dumpdates *, char *));
 static void readdumptimes __P((FILE *));
 
 void
-initdumptimes(void)
+initdumptimes(int createdumpdates)
 {
        FILE *df;
 
@@ -103,25 +99,31 @@ initdumptimes(void)
                            strerror(errno));
                        /* NOTREACHED */
                }
-               /*
-                * Dumpdates does not exist, make an empty one.
-                */
-               msg("WARNING: no file `%s', making an empty one\n", dumpdates);
-               if ((df = fopen(dumpdates, "w")) == NULL) {
-                       quit("cannot create %s: %s\n", dumpdates,
-                           strerror(errno));
-                       /* NOTREACHED */
+               if (createdumpdates) {
+                       /*
+                        * Dumpdates does not exist, make an empty one.
+                        */
+                       msg("WARNING: no file `%s', making an empty one\n", dumpdates);
+                       if ((df = fopen(dumpdates, "w")) == NULL) {
+                               quit("cannot create %s: %s\n", dumpdates,
+                               strerror(errno));
+                               /* NOTREACHED */
+                       }
+                       (void) fclose(df);
+                       if ((df = fopen(dumpdates, "r")) == NULL) {
+                               quit("cannot read %s even after creating it: %s\n",
+                               dumpdates, strerror(errno));
+                               /* NOTREACHED */
+                       }
                }
+               else
+                       msg("WARNING: no file `%s'\n", dumpdates);
+       }
+       if (df != NULL) {
+               (void) flock(fileno(df), LOCK_SH);
+               readdumptimes(df);
                (void) fclose(df);
-               if ((df = fopen(dumpdates, "r")) == NULL) {
-                       quit("cannot read %s even after creating it: %s\n",
-                           dumpdates, strerror(errno));
-                       /* NOTREACHED */
-               }
        }
-       (void) flock(fileno(df), LOCK_SH);
-       readdumptimes(df);
-       (void) fclose(df);
 }
 
 static void
@@ -152,7 +154,7 @@ readdumptimes(FILE *df)
 }
 
 void
-getdumptime(void)
+getdumptime(int createdumpdates)
 {
        register struct dumpdates *ddp;
        register int i;
@@ -166,13 +168,15 @@ getdumptime(void)
        spcl.c_ddate = 0;
        lastlevel = '0';
 
-       /* if we're not going to update dumpdates, there's no point in reading
-          it, particularly since /var might not be mounted... wait until here
-          to benefit from the initialization of variables needed by parent */
-       if (uflag == 0)
+       /* If this is a level 0 dump, and we're not updating 
+          dumpdates, there's no point in trying to read
+          dumpdates.  It may not exist yet, or may not be mounted.  For
+          incrementals, we *must* read dumpdates (fail if it's not there!) */
+       if ( (level == lastlevel) && !createdumpdates)
+               return;
+       initdumptimes(createdumpdates);
+       if (ddatev == NULL)
                return;
-
-       initdumptimes();
        /*
         *      Go find the entry with the same name for a lower increment
         *      and older date
@@ -258,7 +262,7 @@ static void
 dumprecout(FILE *file, struct dumpdates *what)
 {
 
-       if (fprintf(file, DUMPOUTFMT,
+       if (fprintf(file, "%s %c %s",
                    what->dd_name,
                    what->dd_level,
                    ctime(&what->dd_ddate)) < 0)
@@ -290,10 +294,27 @@ getrecord(FILE *df, struct dumpdates *ddatep)
 static int
 makedumpdate(struct dumpdates *ddp, char *tbuf)
 {
-       char un_buf[BUFSIZ];
+       char *tok;
+       
+       /* device name */
+       if ( NULL == (tok = strsep( &tbuf, " ")) )
+               return(-1);
+       if ( strlen(tok) >  MAXPATHLEN )
+               return(-1);
+       strcpy(ddp->dd_name, tok);
+
+       /* eat whitespace */
+       for( ; *tbuf == ' ' ; tbuf++);
+
+       /* dump level */
+       ddp->dd_level = *tbuf;
+       ++tbuf;
+
+       /* eat whitespace */
+       for( ; *tbuf == ' ' ; tbuf++);
 
-       (void) sscanf(tbuf, DUMPINFMT, ddp->dd_name, &ddp->dd_level, un_buf);
-       ddp->dd_ddate = unctime(un_buf);
+       /* dump date */
+       ddp->dd_ddate = unctime(tbuf);
        if (ddp->dd_ddate < 0)
                return(-1);
        return(0);