From 2a3f56502b52375c3bf113cf92adfa99bad6b488 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Tue, 5 Apr 2016 23:55:48 +0300 Subject: [PATCH 5/5] Reject SET commands with newline characters in the string values Many of the global configuration parameters are written as strings without filtering and if there is an embedded newline character in the value, unexpected configuration file data might be written. This fixes an issue where wpa_supplicant could have updated the configuration file global parameter with arbitrary data from the control interface or D-Bus interface. While those interfaces are supposed to be accessible only for trusted users/applications, it may be possible that an untrusted user has access to a management software component that does not validate the value of a parameter before passing it to wpa_supplicant. This could allow such an untrusted user to inject almost arbitrary data into the configuration file. Such configuration file could result in wpa_supplicant trying to load a library (e.g., opensc_engine_path, pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user controlled location when starting again. This would allow code from that library to be executed under the wpa_supplicant process privileges. Signed-off-by: Jouni Malinen --- wpa_supplicant/config.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c index 69152ef..d9a1603 100644 --- a/wpa_supplicant/config.c +++ b/wpa_supplicant/config.c @@ -3764,6 +3764,12 @@ static int wpa_global_config_parse_str(const struct global_parse_data *data, return -1; } + if (has_newline(pos)) { + wpa_printf(MSG_ERROR, "Line %d: invalid %s value with newline", + line, data->name); + return -1; + } + tmp = os_strdup(pos); if (tmp == NULL) return -1; -- 1.9.1 'txt' type='search' size='10' name='q' value=''/>
path: root/build-aux/update-NEWS.scm
AgeCommit message (Expand)Author
2021-05-10maint: update-NEWS: Sort packages prior writing to the data file....* build-aux/update-NEWS.scm (main): Sort packages. Maxim Cournoyer
2021-04-23build-aux: Relax the regexp used to match NEWS sections....A number of packages doesn't really make sense in the name of the section to be substituted. This change allows using simply '*** new packages' instead of '*** 1999 new packages', for example, and have the update-NEWS.scm script update it. * build-aux/update-NEWS.scm (write-packages-added) <regexp>: Do not care about leading white space in the name of the section. Maxim Cournoyer