alpine 3.9
format weakness #25

4

Weakness Breakdown


Definition:

A format string exploit occurs when the data of an input string is evaluated as a command by the program. This class of attacks is very similar to buffer overflows since an attacker could execute code, read the stack or cause new behaviors that compromise security. Learn more about format string attacks on OWASP attack index.

Warning code(s):

Potential format string problem.

File Name:

libwpd/src/libwpd-0.10.2/src/lib/WPXContentListener.cpp

Context:

The highlighted line of code below is the trigger point of this particular Alpine 3.9 format weakness.

 	}
	m_ps->m_isTableRowOpened = false;
}

const double WPX_DEFAULT_TABLE_BORDER_WIDTH = 0.0007f;

static void addBorderProps(const char *border, bool borderOn, const librevenge::RVNGString &borderColor, librevenge::RVNGPropertyList &propList)
{
#if 0
// WLACH: a (not working, obviously) sketch of an alternate way of doing this
// in case it turns out to be desirable. Right now it appears not, as we would have to
// retranslate them on import to OOo (because they don't completely support xsl-fo)
// .. but it would make things way easier in Abi.
	if (borderOn)
	{
		propList.insert("fo:border-left-width", WPX_DEFAULT_TABLE_BORDER_WIDTH);
		propList.insert("fo:border-left-style", "solid");
		propList.insert("fo:border-left-color", borderColor);
	}
	else
		propList.insert("fo:border-left-width", 0.0);
#endif

	librevenge::RVNGString borderStyle;
	borderStyle.sprintf("fo:border-%s", border);
	librevenge::RVNGString props;
	if (borderOn)
	{
		props.append(doubleToString(WPX_DEFAULT_TABLE_BORDER_WIDTH));
		props.append("in solid ");
		props.append(borderColor);
	}
	else
		props.sprintf("0.0in");
	propList.insert(borderStyle.cstr(), props);
}

void WPXContentListener::_openTableCell(const unsigned char colSpan, const unsigned char rowSpan, const unsigned char borderBits,
                                        const RGBSColor *cellFgColor, const RGBSColor *cellBgColor,
                                        const RGBSColor *cellBorderColor, const WPXVerticalAlignment cellVerticalAlignment)
{
	if (!m_ps->m_isTableOpened || !m_ps->m_isTableRowOpened)
		throw ParseException();

	unsigned char tmpColSpan = colSpan;
	if (m_ps->m_isTableCellOpened)
		_closeTableCell();

	if (m_ps->m_currentTableCol < 0)
		throw ParseException(); 

The registered trademark Linux® is used pursuant to a sublicense from the Linux Foundation, the exclusive licensee of Linus Torvalds, owner of the mark on a world­wide basis.