From c6083b97dc69c0995c6a63ecb7fe25900a8a2380 Mon Sep 17 00:00:00 2001
From: Fabrice Bellet <fabrice@bellet.info>
Date: Sun, 22 Sep 2013 12:19:18 +0200
Subject: [PATCH] check to be sure that %n is not being set as format type
(CVE-2012-2090)
---
src/Environment/fgclouds.cxx | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/src/Environment/fgclouds.cxx b/src/Environment/fgclouds.cxx
index 58653e0..c44e7ee 100644
--- a/src/Environment/fgclouds.cxx
+++ b/src/Environment/fgclouds.cxx
@@ -218,6 +218,15 @@ void FGClouds::buildLayer(int iLayer, const string& name, double coverage) {
double count = acloud->getDoubleValue("count", 1.0);
tCloudVariety[CloudVarietyCount].count = count;
int variety = 0;
+ // It is never safe for cloud_name.c_str to be %n.
+ string unsafe ("%n");
+ size_t found;
+
+ found=cloud_name.find(unsafe);
+ if (found!=string::npos) {
+ SG_LOG(SG_GENERAL, SG_ALERT, "format type contained %n, but this is unsafe , ignore it");
+ continue;
+ }
char variety_name[50];
do {
variety++;
--
2.1.0