Re: RFS: atris - Alizarin Tetris

[Steve Kemp <skx@debian.org>]

On Mon, Jul 05, 2004 at 09:14:21PM +0200, Marcel Sebek wrote:

> I've packaged atris - Alizarin Tetris. It is available at
> mentors.debian.net in two packages: atris and atris-sounds. I'm
> searching a sponsor who will upload it.
> Any comments are welcome.

  Please consider applying the attached patch.  This
 protects against two (identical) buffer overflows allowing
 a local gid(games) attack.

  It's always worth checking over the source to any binaries
 you want to install setgid/setuid.

Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit

--- atris.c-orig	2004-07-05 21:00:47.000000000 +0100
+++ atris.c	2004-07-05 21:01:22.000000000 +0100
@@ -929,7 +929,8 @@
 #else
     {
 	char filespec[2048];
-	sprintf(filespec,"%s/.atrisrc", getenv("HOME"));
+	memset(filespec,'\0',sizeof(filespec));
+	snprintf(filespec,sizeof(filespec)-1,"%s/.atrisrc", getenv("HOME"));
 	load_options(filespec);
     }
 #endif
@@ -1124,7 +1125,8 @@
 #else
     {
 	char filespec[2048];
-	sprintf(filespec,"%s/.atrisrc", getenv("HOME"));
+	memset(filespec,'\0',sizeof(filespec));
+	snprintf(filespec,sizeof(filespec)-1,"%s/.atrisrc", getenv("HOME"));
 	save_options(filespec);
     }
 #endif