23 lines
646 B
Diff
23 lines
646 B
Diff
Subject: Fix format string vulnerability (CVE-2014-9157) in yyerror() routine
|
|
Origin: https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081
|
|
Bug-Debian: https://bugs.debian.org/772648
|
|
Forwarded: no
|
|
Author: Emden R. Gansner
|
|
Last-Update: 2014-12-10
|
|
|
|
---
|
|
lib/cgraph/scan.l | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
--- lib/cgraph/scan.l
|
|
+++ lib/cgraph/scan.l
|
|
@@ -225,7 +225,7 @@ void yyerror(char *str)
|
|
agxbput (&xb, buf);
|
|
agxbput (&xb, yytext);
|
|
agxbput (&xb,"'\n");
|
|
- agerr(AGERR,agxbuse(&xb));
|
|
+ agerr(AGERR, "%s", agxbuse(&xb));
|
|
agxbfree(&xb);
|
|
}
|
|
/* must be here to see flex's macro defns */
|