diff options
| author | Matthew Barnes <mbarnes@redhat.com> | 2007-03-30 03:59:59 +0800 |
|---|---|---|
| committer | Matthew Barnes <mbarnes@src.gnome.org> | 2007-03-30 03:59:59 +0800 |
| commit | 6a45ba93268ab730b75325f05f19aed23084b2dc (patch) | |
| tree | 992758e2e2f6f18d3b273a90fc90066f333e3aeb /calendar | |
| parent | 860676317c11fe96f4e9216aa16e0fd9b18a9dd4 (diff) | |
| download | gsoc2013-evolution-6a45ba93268ab730b75325f05f19aed23084b2dc.tar gsoc2013-evolution-6a45ba93268ab730b75325f05f19aed23084b2dc.tar.gz gsoc2013-evolution-6a45ba93268ab730b75325f05f19aed23084b2dc.tar.bz2 gsoc2013-evolution-6a45ba93268ab730b75325f05f19aed23084b2dc.tar.lz gsoc2013-evolution-6a45ba93268ab730b75325f05f19aed23084b2dc.tar.xz gsoc2013-evolution-6a45ba93268ab730b75325f05f19aed23084b2dc.tar.zst gsoc2013-evolution-6a45ba93268ab730b75325f05f19aed23084b2dc.zip | |
Use a format string ("%s") when passing uncontrolled data to a
2007-03-29 Matthew Barnes <mbarnes@redhat.com>
* gui/e-cal-component-memo-preview.c (write_html):
Use a format string ("%s") when passing uncontrolled data to a
printf-style function (CVE-2007-1002).
svn path=/trunk/; revision=33342
Diffstat (limited to 'calendar')
| -rw-r--r-- | calendar/ChangeLog | 6 | ||||
| -rw-r--r-- | calendar/gui/e-cal-component-memo-preview.c | 2 |
2 files changed, 7 insertions, 1 deletions
diff --git a/calendar/ChangeLog b/calendar/ChangeLog index eb3ed1a71a..e7502367a2 100644 --- a/calendar/ChangeLog +++ b/calendar/ChangeLog @@ -1,5 +1,11 @@ 2007-03-29 Matthew Barnes <mbarnes@redhat.com> + * gui/e-cal-component-memo-preview.c (write_html): + Use a format string ("%s") when passing uncontrolled data to a + printf-style function (CVE-2007-1002). + +2007-03-29 Matthew Barnes <mbarnes@redhat.com> + * gui/e-day-view.c: * gui/e-week-view.c: * gui/tasks-control.c: diff --git a/calendar/gui/e-cal-component-memo-preview.c b/calendar/gui/e-cal-component-memo-preview.c index 192ad70ee1..07b2f79964 100644 --- a/calendar/gui/e-cal-component-memo-preview.c +++ b/calendar/gui/e-cal-component-memo-preview.c @@ -185,7 +185,7 @@ write_html (GtkHTMLStream *stream, ECal *ecal, ECalComponent *comp, icaltimezone } } - gtk_html_stream_printf(stream, string->str); + gtk_html_stream_printf(stream, "%s", string->str); g_string_free (string, TRUE); |