Untitled

//This is the function that results in the vulnerability from buffer.c :
int unpack_string(buffer_ptr b, char *s)
{
    int i;
    int len;
    byte *bp;

    if ((b->read_index + INT32_SIZE) > b->len) {
        fprintf(stderr, "unpack_string(): %s\n", BUFF_ERR2);
        return (-1);
    }

    len = unpack_int(b);

    if ((b->read_index + len) > b->len) {
        fprintf(stderr, "unpack_string(): %s\n", BUFF_ERR2);
        return (-1);
    }

    bp = (byte *) s;

    for (i = 0; i < (len-1); i++) {
        *(bp++) = b->data[b->read_index++];
    }

    *(bp) = 0;
    b->read_index++;

    return (0);
}


//It unpacks a string from pack_string :
int pack_string(buffer_ptr b, const char *s)
{
    int i;
    int len;
    byte *bp;

    len = strlen((char *) s);

    if (pack_int(b, len)) {
        fprintf(stderr, "pack_string(): pack_int() failed\n");
        return -2;
    }

    if ((b->len + len + 1) >= BUF_SIZE) {
        fprintf(stderr, "pack_string(): %s\n", BUFF_ERR1);
        return (-1);
    }

    b->data[b->len++] = ' ';

    bp = (byte *) s;

    for (i = 0; i < len; i++) {
        b->data[b->len++] = *(bp++);
    }

    b->data[b->len] = 0;

    return (0);
}


//This is how the function is used (unpack_string = msg_unpack_string)
void nio_app_init_1(void)
{
    char nio_ver[STR_LEN];
    char server[STR_LEN];
    char app_name[STR_LEN];
    char app_ver[STR_LEN];
    char cwd[STR_LEN];
//  printf("Initializing remote application...\n");

    msg_unpack_string(nio_ver);
    msg_unpack_string(server);
    msg_unpack_string(app_name);
    msg_unpack_string(app_ver);
    msg_unpack_string(cwd);

    init_file_loader(app_name, app_ver, cwd);

    // turn antialiasing on
    antialiasing_control(TRUE);

//      printf("nio_init_1:\n");
//      printf(" nio_ver = %s\n", nio_ver);
//      printf(" server = %s\n", server);
//      printf(" app_name = %s\n", app_name);
//      printf(" app_ver = %s\n", app_ver);
//      printf(" cwd = %s\n", cwd);
}


//That's just one vulnerability I've showed, resulting from the nio_app_init() api :
void nio_app_init(const char *app_name, const char *app_ver)
{
    char nio_ver[8] = NIO_LIB_VER;
    char hostname[MAXHOSTNAMELEN];
    char cwd[256];
    char s[BUFSIZ];
//      path nio_log;

    /*
       get_home_dir(nio_log);    // Get home dir
       pathcat(nio_log, NIO_DIR);   // append nio dir
       check_dir(nio_log);    // make sure we can write to it

       // create log file name
     */

    snprintf(s, BUFSIZ, "%s.%s.log", app_name, app_ver);

    nio_log_open(s);

    /*
    // append log file name to path
    pathcat(nio_log, s);

    // open the log file
    nio_log_open(nio_log);
*/

#ifdef UNIX
    if (signal(SIGUSR1, sig_usr) == SIG_ERR)
        nio_log_print("can't catch SIGUSR1\n");
#endif

//      nio_log_print("nio_app_init(): log file |%s| opened.\n", nio_log);
    nio_log_print("nio_app_init(): log file |%s| opened.\n", s);

#ifdef WIN32
    init_winsock();
#endif

    nio_StartEventQueue();

    nio_log_print("nio_app_init(): Event queue started.\n", s);

    msg_init_server(STDIN, STDOUT);

    nio_log_print("nio_app_init(): msg_init_stdio_server() done.\n");

    gethostname(hostname, MAXHOSTNAMELEN);

    getcwd(cwd, 256);

    msg_set_num(NIO_OUT_INIT);

    nio_log_print("nio_app_init(): msg_set_num() done.\n");

    msg_pack_string(nio_ver);
    msg_pack_string(hostname);
    msg_pack_string(app_name);
    msg_pack_string(app_ver);
    msg_pack_string(cwd);
//      msg_send();

    nio_log_print("nio_app_init(): Done packing message.\n");

    randomize();
}