Buffer overflow in dump, as reported from Bugtraq

[dump.git] / dump / tape.c

diff --git a/dump/tape.c b/dump/tape.c
index c08019865bc2a96f5e4443115e5da081c0d1215a..5a50ff95aaf66e814efad447026639090b8814e9 100644 (file)
--- a/dump/tape.c
+++ b/dump/tape.c
@@ -2,7 +2,7 @@
  *     Ported to Linux's Second Extended File System as part of the
  *     dump and restore backup suit
  *     Remy Card <card@Linux.EU.Org>, 1994-1997
- *     Stelian Pop <pop@cybercable.fr>, 1999 
+ *     Stelian Pop <pop@cybercable.fr>, 1999-2000
  */
 
 /*-
@@ -40,7 +40,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-       "$Id: tape.c,v 1.10 2000/01/07 19:24:04 tiniou Exp $";
+       "$Id: tape.c,v 1.14 2000/03/01 10:16:05 stelian Exp $";
 #endif /* not lint */
 
 #ifdef __linux__
@@ -311,6 +311,8 @@ statussig(int notused)
 #else
        (void) time((time_t *) &tnow);
 #endif
+       if (blockswritten > tapesize)
+               tapesize = blockswritten;
        deltat = tstart_writing - tnow + (1.0 * (tnow - tstart_writing))
                / blockswritten * tapesize;
        (void)snprintf(msgbuf, sizeof(msgbuf),
@@ -713,8 +715,8 @@ restore_check_point:
                 */
                tapeno++;               /* current tape sequence */
                if (Mflag) {
-                       snprintf(tape, NAME_MAX, "%s%03d", tapeprefix, tapeno);
-                       tape[NAME_MAX - 1] = '\0';
+                       snprintf(tape, MAXPATHLEN, "%s%03d", tapeprefix, tapeno);
+                       tape[MAXPATHLEN - 1] = '\0';
                        msg("Dumping volume %d on %s\n", tapeno, tape);
                }
                else if (nexttape || strchr(tapeprefix, ',')) {
@@ -725,15 +727,16 @@ restore_check_point:
                                nexttape = p + 1;
                        } else
                                nexttape = NULL;
-                       strncpy(tape, tapeprefix, NAME_MAX);
-                       tape[NAME_MAX - 1] = '\0';
+                       strncpy(tape, tapeprefix, MAXPATHLEN);
+                       tape[MAXPATHLEN - 1] = '\0';
                        msg("Dumping volume %d on %s\n", tapeno, tape);
                }
 #ifdef RDUMP
-               while ((tapefd = (host ? rmtopen(tape, 2) :
-                       pipeout ? 1 : open(tape, O_WRONLY|O_CREAT, 0666))) < 0)
+               while ((tapefd = (host ? rmtopen(tape, 2) : pipeout ? 
+                       fileno(stdout) : 
+                       open(tape, O_WRONLY|O_CREAT, 0666))) < 0)
 #else
-               while ((tapefd = (pipeout ? 1 :
+               while ((tapefd = (pipeout ? fileno(stdout) :
                                  open(tape, O_WRONLY|O_CREAT, 0666))) < 0)
 #endif
                    {