unsafe use of system(3), sprintf(3)

[Seth Arnold]

The system(3) and sprintf(3) library calls are used in an unsafe manner in cryptcab:

static struct peer *generate_and_xmit(struct peer *ret){
        char command[255];
        int res;
        struct hostent *target;

        ret=generate_key(ret);

        if(!ret){
                fprintf(stderr,"Couldn't create the secret key.\n");
                exit(255);
        }

        target=gethostbyname(remotehost);
        if (target == NULL)
        {
                fprintf(stderr,"%s not found.\n", remotehost);
                exit(2);
        }
        ret->in_a.sin_family = AF_INET;
        ret->in_a.sin_port = htons(remoteport);
        ret->in_a.sin_addr.s_addr=((struct in_addr *)(target->h_addr))->s_addr;
        if(!pre_shared){
                vc_printlog(2,"Sending key over ssh channel:");
                if(remoteusr)
                        sprintf(command,"scp %s /tmp/.blowfish.key %s@%s:/tmp/.%s.key 2>&1",
                                scp_extra_options?scp_extra_options:"",
                                remoteusr, remotehost, ret->id);
                else
                        sprintf(command,"scp %s /tmp/.blowfish.key %s:/tmp/.%s.key 2>&1",
                                scp_extra_options?scp_extra_options:"",
                                remotehost, ret->id);

                //fprintf(stderr,"Contacting host: %s ",remotehost);
                res=system(command);

[Seth Arnold (seth-arnold)]

https://sourceforge.net/tracker/?func=detail&aid=3603894&group_id=95403&atid=611248