fly/flightgear
1
0
Fork 0
Code Activity

Fix for #1117:

Browse source 
fix another issue similar to CVE-2012-2090
 In FGClouds::buildlayer(), prevent passing '%n' to snprintf().
From: Rebecca Palmer
This commit is contained in:
James Turner 2013-09-14 17:43:24 +01:00
parent dab588c789
commit 9457ba024a
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/Environment/fgclouds.cxx
View file

@ -214,11 +214,10 @@ void FGClouds::buildLayer(int iLayer, const string& name, double coverage) {
double count = acloud->getDoubleValue("count", 1.0);
tCloudVariety[CloudVarietyCount].count = count;
int variety = 0;
cloud_name = cloud_name + "-%d";
char variety_name[50];
do {
variety++;
snprintf(variety_name, sizeof(variety_name) - 1, cloud_name.c_str(), variety);
snprintf(variety_name, sizeof(variety_name) - 1, "%s-%d", cloud_name.c_str(), variety);
} while( box_def_root->getChild(variety_name, 0, false) );
totalCount += count;