Samba smbclient―書式指定文字列に潜む脆弱性

/* Get us the current top of the talloc stack. */
TALLOC_CTX *talloc_tos(void);

/* strdup with a talloc */
char *talloc_strdup(const void *t, const char *p);

/* Get the next token from a string, return false if none found. */
bool next_token_talloc(TALLOC_CTX *ctx,
            const char **ptr, char **pp_buff, const char *sep);

/* print intenal strings in the "display charset" */
int d_printf(const char *format, ...);

/*
  Realloc s to append the formatted result of fmt and return s,
  which may have moved.  Good for gradually accumulating output
  into a string buffer.
 */
char *talloc_asprintf_append(char *s, const char *fmt, ...);

/* Reduce a file name, removing .. elements. */
char *clean_name(TALLOC_CTX *ctx, const char *s);

/* Get a file from rname to lname */
static int do_get(const char *rname, const char *lname_in, bool reget);

/****************************************************************************
 Get a file.
****************************************************************************/

static int cmd_get(void)
{
    TALLOC_CTX *ctx = talloc_tos();
    char *lname = NULL;
    char *rname = NULL;
    char *fname = NULL;

    rname = talloc_strdup(ctx, client_get_cur_dir());
    if (!rname) {
        return 1;
    }

    if (!next_token_talloc(ctx, &cmd_ptr,&fname,NULL)) {
        d_printf("get <filename> [localname]\n");
        return 1;
    }
    rname = talloc_asprintf_append(rname, fname);
    if (!rname) {
        return 1;
    }
    rname = clean_name(ctx, rname);
    if (!rname) {
        return 1;
    }

    next_token_talloc(ctx, &cmd_ptr,&lname,NULL);
    if (!lname) {
        lname = fname;
    }

    return do_get(rname, lname, false);
}