Buffer overflow in dump, as reported from Bugtraq

[dump.git] / dump / itime.c

diff --git a/dump/itime.c b/dump/itime.c
index f0fa41454de2856c2906b0125cd0de6efcbee7b5..64d7644c6f8123f4e6ec31e1fb17602b030b015c 100644 (file)
--- a/dump/itime.c
+++ b/dump/itime.c
@@ -2,7 +2,7 @@
  *     Ported to Linux's Second Extended File System as part of the
  *     dump and restore backup suit
  *     Remy Card <card@Linux.EU.Org>, 1994-1997
- *     Stelian Pop <pop@cybercable.fr>, 1999 
+ *     Stelian Pop <pop@cybercable.fr>, 1999-2000
  */
 
 /*-
@@ -40,7 +40,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-       "$Id: itime.c,v 1.6 1999/10/13 09:57:19 stelian Exp $";
+       "$Id: itime.c,v 1.10 2000/03/01 10:16:05 stelian Exp $";
 #endif /* not lint */
 
 #include <sys/param.h>
@@ -168,10 +168,11 @@ getdumptime(int createdumpdates)
        spcl.c_ddate = 0;
        lastlevel = '0';
 
-       /* if we're not going to update dumpdates, there's no point in reading
-          it, particularly since /var might not be mounted... wait until here
-          to benefit from the initialization of variables needed by parent */
-       if (!uflag && level == lastlevel)
+       /* If this is a level 0 dump, and we're not updating 
+          dumpdates, there's no point in trying to read
+          dumpdates.  It may not exist yet, or may not be mounted.  For
+          incrementals, we *must* read dumpdates (fail if it's not there!) */
+       if ( (level == lastlevel) && !createdumpdates)
                return;
        initdumptimes(createdumpdates);
        if (ddatev == NULL)
@@ -261,7 +262,7 @@ static void
 dumprecout(FILE *file, struct dumpdates *what)
 {
 
-       if (fprintf(file, DUMPOUTFMT,
+       if (fprintf(file, "%s %c %s",
                    what->dd_name,
                    what->dd_level,
                    ctime(&what->dd_ddate)) < 0)
@@ -293,10 +294,27 @@ getrecord(FILE *df, struct dumpdates *ddatep)
 static int
 makedumpdate(struct dumpdates *ddp, char *tbuf)
 {
-       char un_buf[BUFSIZ];
+       char *tok;
+       
+       /* device name */
+       if ( NULL == (tok = strsep( &tbuf, " ")) )
+               return(-1);
+       if ( strlen(tok) >  MAXPATHLEN )
+               return(-1);
+       strcpy(ddp->dd_name, tok);
+
+       /* eat whitespace */
+       for( ; *tbuf == ' ' ; tbuf++);
+
+       /* dump level */
+       ddp->dd_level = *tbuf;
+       ++tbuf;
+
+       /* eat whitespace */
+       for( ; *tbuf == ' ' ; tbuf++);
 
-       (void) sscanf(tbuf, DUMPINFMT, ddp->dd_name, &ddp->dd_level, un_buf);
-       ddp->dd_ddate = unctime(un_buf);
+       /* dump date */
+       ddp->dd_ddate = unctime(tbuf);
        if (ddp->dd_ddate < 0)
                return(-1);
        return(0);