#992412 ispell: buffer overflow through sprintf

Package:
ispell
Source:
ispell
Description:
International Ispell (an interactive spelling corrector)
Submitter:
Wooseok Kang
Date:
2021-08-18 08:48:06 UTC
Severity:
normal
#992412#5
Date:
2021-08-18 08:46:44 UTC
From:
To:
Dear Maintainer,

there are potential buffer overflow vulnerabilities in ispell.

In tree.c:163, the program reads the value of 'h' from an environment variable.
Then at line 219 and 278, it is used to sprintf with no length check.
Since the size of 'personaldict' is fixed, it may cause buffer overflow which leads to buggy behavior.
--------------------------------------------------
163 if ((h = getenv (HOME)) == NULL)
...
219 (void) sprintf (personaldict, "%s/%s%s", h == NULL ? "" : h,
220     DEFPDICT, LibDict);
...
278 (void) sprintf (personaldict, "%s/%s", h, p);
--------------------------------------------------


Similar issus are appear in ispell.c

--------------------------------------------------
295 p = getenv (DICTIONARYVAR);
296 if (p != NULL)
297 {
298   if (last_slash (p) != NULL)
299     (void) strcpy (hashname, p);
300   else
301     (void) sprintf (hashname, "%s/%s", libdir, p);
--------------------------------------------------
1013 (void) sprintf (logfilename, "%s/%s/%s",
1014     getenv ("HOME") == NULL ? "" : getenv ("HOME"),
1015     DEFLOGDIR, LibDict);
--------------------------------------------------

Thank you.