Codebase list lbreakout2 / ca70f1b
Import Debian changes 2.5.2-2 lbreakout2 (2.5.2-2) unstable; urgency=high * Apply backported security fixes for bad usage of s*printf/scanf. Thanks to Moritz Muehlenhoff for spotting the problem in the upstream changelog and for sifting through the diff to find the relevant fixes. (Closes: #310468) Daniel Burrows authored 18 years ago Andreas Tille committed 5 years ago
9 changed file(s) with 29 addition(s) and 21 deletion(s). Raw diff Collapse all Expand all
+2
-2
client/chart.c less more
137137 if ( aux[0] != '>' ) break;
138138 chart = calloc( 1, sizeof( Set_Chart ) );
139139 /* get name: >>>name */
140 fscanf( file, ">>>%s\n", setname );
140 fscanf( file, ">>>%1023s\n", setname );
141141 chart->name = strdup( setname );
142142 /* entries */
143143 chart_read_entries( file, file_name, chart );
233233 /* open file */
234234 file = fopen( file_name, "w" );
235235 if ( !file ) {
236 fprintf( stderr, "??? Highscore chart loaded properly but cannot save?\n" );
236 fprintf( stderr, "??? Highscore chart loaded properly but cannot save? (%s)\n",file_name );
237237 return;
238238 }
239239 /* save all charts */
+1
-1
client/client_handlers.c less more
145145
146146 /* extract ip and port and build a new socket out of it */
147147 gui_edit_get_text( edit_server, server, 128, 0, -1 );
148 snprintf( config.server, 64, server );
148 snprintf( config.server, 64, "%s", server );
149149 if ( !net_build_addr( &newaddr, server, 0 ) ) {
150150 client_printf_chatter( 1, "ERROR: address %s does not resolve", config.server );
151151 return;
+3
-3
client/client_recv.c less more
156156 /* users */
157157 case MSG_ADD_USER:
158158 num = msg_read_int32();
159 snprintf( name, 16, msg_read_string() ); name[15] = 0;
159 snprintf( name, 16, "%s", msg_read_string() ); name[15] = 0;
160160 if ( msg_read_failed() ) break;
161161 client_add_user( num, name );
162162 gui_list_update(
222222 client_transmit( CODE_BLUE, msglen, msgbuf );
223223 break;
224224 }
225 snprintf( mp_peer_name, 15, msg_read_string() );
226 snprintf( mp_levelset, 16, msg_read_string() );
225 snprintf( mp_peer_name, 15, "%s", msg_read_string() );
226 snprintf( mp_levelset, 16, "%s", msg_read_string() );
227227 mp_diff = msg_read_int8();
228228 mp_rounds = msg_read_int8();
229229 mp_frags = msg_read_int8();
+1
-1
client/comm.c less more
236236 break;
237237 case MSG_ADD_USER:
238238 i = msg_read_int32();
239 snprintf( name, 16, msg_read_string() ); name[15] = 0;
239 snprintf( name, 16, "%s", msg_read_string() ); name[15] = 0;
240240 if ( msg_read_failed() ) break;
241241 client_add_user( i, name );
242242 handled = 1;
+2
-2
client/editor.c less more
638638 strcpy( str, "" );
639639 if ( edit_buttons[x][y] == BUTTON_EDIT_AUTHOR )
640640 if ( enter_string( font, "Author's Name:", str, 24 ) ) {
641 snprintf( edit_cur_level->author, 31, str );
641 snprintf( edit_cur_level->author, 31, "%s", str );
642642 *full_update = 1;
643643 }
644644 if ( edit_buttons[x][y] == BUTTON_EDIT_NAME )
645645 if ( enter_string( font, "Title:", str, 24 ) ) {
646 snprintf( edit_cur_level->name, 31, str );
646 snprintf( edit_cur_level->name, 31, "%s", str );
647647 *full_update = 1;
648648 }
649649 /* sel frame tile position */
+8
-0
debian/changelog less more
0 lbreakout2 (2.5.2-2) unstable; urgency=high
1
2 * Apply backported security fixes for bad usage of s*printf/scanf.
3 Thanks to Moritz Muehlenhoff for spotting the problem in the upstream
4 changelog and for sifting through the diff to find the relevant fixes. (Closes: #310468)
5
6 -- Daniel Burrows <dburrows@debian.org> Tue, 24 May 2005 18:52:21 -0700
7
08 lbreakout2 (2.5.2-1) unstable; urgency=low
19
210 * New upstream release
+4
-4
game/comm.c less more
493493 {
494494 char *ptr = msg + *pos;
495495
496 snprintf( ptr, 16, level->name ); ptr[15] = 0; ptr += 16;
497 snprintf( ptr, 16, level->author); ptr[15] = 0; ptr += 16;
496 snprintf( ptr, 16, "%s", level->name ); ptr[15] = 0; ptr += 16;
497 snprintf( ptr, 16, "%s", level->author); ptr[15] = 0; ptr += 16;
498498 memcpy( ptr, level->bricks, 252 ); ptr += 252;
499499 memcpy( ptr, level->extras, 252 ); ptr += 252;
500500
506506 {
507507 char *ptr = msg + *pos;
508508
509 snprintf( level->name, 16, ptr ); ptr += 16;
510 snprintf( level->author, 16, ptr ); ptr += 16;
509 snprintf( level->name, 16, "%s", ptr ); ptr += 16;
510 snprintf( level->author, 16, "%s", ptr ); ptr += 16;
511511 memcpy( level->bricks, ptr, 252 ); ptr += 252;
512512 memcpy( level->extras, ptr, 252 ); ptr += 252;
513513
+6
-6
game/levels.c less more
7373 if ( fname[0] != '/' ) /* keep global pathes */
7474 snprintf( path, sizeof(path)-1, "%s/levels/%s", SRC_DIR, fname );
7575 else
76 snprintf( path, sizeof(path)-1, fname );
76 snprintf( path, sizeof(path)-1, "%s", fname );
7777
7878 if ( ( file = fopen( path, mode ) ) == 0 ) {
7979 fprintf( stderr, "couldn't open %s\n", path );
191191
192192 if ( levels->count == 0 ) return 0;
193193 set = salloc( 1, sizeof( LevelSet ) );
194 snprintf( set->name, 20, name );
194 snprintf( set->name, 20, "%s", name );
195195 set->levels = salloc( levels->count, sizeof( Level* ) );
196196 set->count = levels->count;
197197 set->version = version;
343343 if ( !strequal( "Level:", buffer ) ) goto failure;
344344 /* author */
345345 if ( !next_line( file, buffer ) ) goto failure;
346 snprintf( level->author, 31, buffer );
346 snprintf( level->author, 31, "%s", buffer );
347347 /* level name */
348348 if ( !next_line( file, buffer ) ) goto failure;
349 snprintf( level->name, 31, buffer );
349 snprintf( level->name, 31, "%s", buffer );
350350 /* bricks: */
351351 if ( !next_line( file, buffer ) ) goto failure;
352352 if ( !strequal( "Bricks:", buffer ) ) goto failure;
388388 {
389389 int i, j;
390390 Level *level = calloc( 1, sizeof( Level ) );
391 snprintf( level->author, 31, author );
392 snprintf( level->name, 31, name );
391 snprintf( level->author, 31, "%s", author );
392 snprintf( level->name, 31, "%s", name );
393393 /* empty arena */
394394 for ( i = 0; i < EDIT_WIDTH; i++ )
395395 for ( j = 0; j < EDIT_HEIGHT; j++ ) {
+2
-2
gui/gui_edit.c less more
421421 {
422422 if ( widget->type != GUI_EDIT ) return;
423423 /* copy text */
424 snprintf( widget->spec.edit.buffer, widget->spec.edit.size + 1, text );
424 snprintf( widget->spec.edit.buffer, widget->spec.edit.size + 1, "%s", text );
425425 widget->spec.edit.length = strlen( widget->spec.edit.buffer );
426426 /* reset */
427427 /* first character in first line */
455455 if ( length > limit )
456456 length = limit;
457457 if ( length )
458 snprintf( buffer, limit, widget->spec.edit.buffer );
458 snprintf( buffer, limit, "%s", widget->spec.edit.buffer );
459459 else
460460 buffer[0] = 0;
461461 return 1;