Changeset 50247 in vbox

Timestamp:

Jan 27, 2014 4:22:59 PM (11 years ago)

Author:

vboxsync

Message:

VBoxLogRelCreate: avoid uncontrolled format string attack. This
function takes pcszLogFile argument that appears to be intended as the
literal file name. Don't pass it as pszFilenameFmt format string to
RTLogCreateEx(). Instead format it with "%s".

File:

• trunk/src/VBox/Main/glue/com.cpp (modified) (1 diff)

trunk/src/VBox/Main/glue/com.cpp

@@ -379 +379 @@
                             pcszEnvVarBase, RT_ELEMENTS(s_apszGroups), s_apszGroups, fDestFlags,
                             vboxHeaderFooter, cHistory, uHistoryFileSize, uHistoryFileTime,
-                            pszError, cbError, pcszLogFile);
+                            pszError, cbError,
+                            "%s", pcszLogFile);
     if (RT_SUCCESS(vrc))
     {