From 10a132289ffe4ed9a398bebca13cb41c1006bd13 Mon Sep 17 00:00:00 2001

From: Tomas Hoger <[email protected]>

Date: Wed, 20 May 2015 11:22:11 +0200

Subject: [PATCH 2/2] Additional agerr() format string fixes

Similar to commit 99eda42, ensure the second argument to agerr() is

fixed string with no user inputs.  Change applied to:

* cmd/tools/gmlscan.l - unclear if this can be exploited in practice, as

  only yytext can possibly hold format string

* lib/graph/lexer.c - format string can be injected via graph file

  content.  Note that libgraph is deprecated as of version 2.30.0, so

  this fix is more relevant for older graphviz versions.

---

 cmd/tools/gmlscan.l | 2 +-

 lib/graph/lexer.c   | 6 +++---

 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cmd/tools/gmlscan.l b/cmd/tools/gmlscan.l

index ea8db0f..e83ca4f 100644

--- a/cmd/tools/gmlscan.l

+++ b/cmd/tools/gmlscan.l

@@ -127,7 +127,7 @@ void yyerror(char *str)

 	return;

     errors = 1;

     sprintf(buf," %s in line %d near '%s'\n", str,line_num,yytext);

-    agerr(AGWARN,buf);

+    agerr(AGWARN, "%s", buf);

 }

 int gmlerrors()

diff --git a/lib/graph/lexer.c b/lib/graph/lexer.c

index 05452c8..790563b 100644

--- a/lib/graph/lexer.c

+++ b/lib/graph/lexer.c

@@ -460,16 +460,16 @@ static void error_context(void)

     if (buf < p) {

 	c = *p;

 	*p = '\0';

-	agerr(AGPREV, buf);

+	agerr(AGPREV, "%s", buf);

 	*p = c;

     }

     agerr(AGPREV, " >>> ");

     c = *LexPtr;

     *LexPtr = '\0';

-    agerr(AGPREV, p);

+    agerr(AGPREV, "%s", p);

     *LexPtr = c;

     agerr(AGPREV, " <<< ");

-    agerr(AGPREV, LexPtr);

+    agerr(AGPREV, "%s", LexPtr);

 }

 void agerror(char *msg)