#985248 gnuplot: format string bug in PS_load_fontfile()

Package:
gnuplot
Source:
gnuplot
Submitter:
Wooseok Kang
Date:
2021-03-15 02:36:04 UTC
Severity:
normal
#985248#5
Date:
2021-03-15 02:33:00 UTC
From:
To:
Dear Maintainer,

In gnuplot, there is a format string vulnerability
that can lead to read and write arbitrary memory values.

In term/post.trm, the program get string from getenv() and pass it to sprintf() directly in line 1420.
This causes the format string bug which can crash the program.

1420 envcmd = getenv("GNUPLOT_TTFTOPFA");
1421 if (envcmd != NULL)
1422     sprintf(cmd,envcmd,current_ps_fontfile->fontfile_fullname);

Thank you.