In src/resource.c, there are multiple potential buffer overflow vulnerabilities.


At line 202, the program gets the value of 'locale' from an environment variable.

------------------------------
202 locale = getenv("LC_ALL");
203 if ( !locale || !*locale )
204   locale = getenv("LC_MESSAGES");
205 if ( !locale || !*locale )
206   locale = getenv("LANG");
207 if ( !locale || !*locale )
208   locale = "C";
------------------------------


From 211 to 228, the string in 'locale' is stored to 'loc_lang'.
After that, sprintf calls use 'loc_lang' with no length check.
Since the size of 'locale1', 'local2' and 'locale3' are all fixed to 100
if a malicious attacker puts a large string to the environment variable, it may cause stack buffer overflow that leads to buggy behavior.

------------------------------
210 {
211   char* cL, * cP;
212
213   cP = loc_lang;
214   cL = locale;
215  
216   *loc_terr = 0;
217   *loc_cs = 0;
218   *loc_mod = 0;
219     
220   while (*cL)
221   {
222     if ( *cL == '_' ) { *cP = 0; cP = loc_terr; }
223     if ( *cL == '.' ) { *cP = 0; cP = loc_cs; }
224     if ( *cL == '@' ) { *cP = 0; cP = loc_mod; }
225       *cP++ = *cL++;
226     }
227     *cP = 0;
228   }
229
230   s = resource_getResource(db,app_class,app_name, "international",0);
231   if (s == NULL || !strcasecmp(s, "False"))
232   {
233     sprintf(locale1, "noint:%s%s", loc_lang, loc_terr);
234     sprintf(locale2, "noint:%s", loc_lang);
235     strcpy(locale3, "C");
236   }
237   else
238   {
239     strcpy(locale1, locale);
240     sprintf(locale2, "%s%s%s", loc_lang, loc_terr, loc_cs);
241     sprintf(locale3, "%s%s", loc_lang, loc_cs);
242   }
------------------------------