Author: rmeggins
Update of /cvs/dirsec/adminutil/lib/libadmsslutil
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv11998/adminutil/lib/libadmsslutil
Modified Files:
admsslutil.c
Log Message:
Bug(s) fixed: 186280
Bug Description: Close potential security vulnerabilities in CGI code
Reviewed by: Noriko (Thanks!)
Fix Description: The code was already pretty clean in terms of buffer
access. I added some malloc return checking, used some nspr functions
where applicable, removed some dead code, and fixed a couple of small
memory leaks.
Platforms tested: Fedora Core 5
Flag Day: no
Doc impact: no
QA impact: should be covered by regular nightly and manual testing
New Tests integrated into TET: none
Index: admsslutil.c
===================================================================
RCS file: /cvs/dirsec/adminutil/lib/libadmsslutil/admsslutil.c,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- admsslutil.c 6 Dec 2005 18:38:42 -0000 1.2
+++ admsslutil.c 22 Mar 2006 23:47:20 -0000 1.3
@@ -144,20 +144,12 @@
filename++; /* Skip '/' */
}
- /* basename is either "-cert" or "-key" */
- base = strstr(filename, basename);
+ /* basename is either "-cert" or "-key" - look for last occurance
*/
+ base = PL_strrstr(filename, basename);
if (base == NULL) {
return;
}
- /*
- * Find the last occurrence of basename in filename in an unlikely
- * scenario that basename (-key or -cert) appears in the prefix
- */
- while (strstr(base+1, basename) != NULL) {
- base = strstr(base+1, basename);
- }
-
/* Include '-' into prefix */
prefixLen = base-filename+1;
if (prefixLen > maxprefixlen) {
@@ -188,6 +180,10 @@
/* PKSC11 module must be configured before NSS is initialized */
db_name = PL_strdup("internal (software) ");
+ if (!db_name) {
+ return -1;
+ }
+
PK11_ConfigurePKCS11(NULL,NULL,NULL,db_name,NULL, NULL,NULL,NULL,
/*minPwdLen=*/8, /*pwdRequired=*/1);
@@ -272,7 +268,11 @@
if((!certdbFile) || (!keydbFile) || (!admroot)) return -1;
- return initNSS(certdbFile, keydbFile);
+ errCode = initNSS(certdbFile, keydbFile);
+ PL_Free(certdbFile);
+ PL_Free(keydbFile);
+
+ return errCode;
}
void servssl_error(char *fmt, ...)
@@ -763,66 +763,6 @@
}
fclose(f);
-
-#ifdef NES
- /* add/edit field in magnus.conf */
- modified_security = 0;
- linecnt = 0;
- PR_snprintf(filename, sizeof(filename),
- "%s/admin-serv/config/magnus.conf", sroot);
-
- f = fopen(filename, "r");
- if (f==NULL) {
- servssl_error("Can not open magnus.conf for reading");
- }
-
- while(fgets(inbuf, sizeof(inbuf), f) != NULL) {
- if(lines[linecnt] != NULL)
- PR_Free(lines[linecnt]);
- if ((strstr(inbuf,"Security ") == inbuf) &&
- (security && *security != '\0')) {
- /* Line starts with "Security" */
- col = strrchr(inbuf,' ');
- if (col == NULL) {
- servssl_error("Bad format for security field in magnus.conf");
- }
- *col=0;
- PR_snprintf(buf, sizeof(buf), "%s %s\n", inbuf, security);
- lines[linecnt++] = PL_strdup(buf);
- modified_security=1;
- }
- else {
- lines[linecnt++] = PL_strdup(inbuf);
- }
- }
- fclose(f);
-
- if ((!modified_security) &&
- (security && *security != '\0')) {
- /* security not found - put it in */
- if(lines[linecnt] != NULL)
- PR_Free(lines[linecnt]);
- PR_snprintf(buf, sizeof(buf), "Security %s\n", security);
- lines[linecnt++] = PL_strdup(buf);
- }
-
- f = fopen(filename, "w");
- if (f==NULL) {
- fclose(f);
- servssl_error("Can not open magnus.conf for writing");
- }
-
- for (i=0; i < linecnt; i++) {
- fprintf(f, "%s", lines[i]);
- }
-
- fclose(f);
-
- for(i=0; i<50; i++) {
- if(lines[i] != NULL)
- PR_Free(lines[i]);
- }
-#endif /* NES */
}