Tcl Source Code

Description: The 'printf' in 'SubstituteFile' accepts a format string as an argument, but the format string originates from the argv[3] which is controlled by user.

Fix: printf("%s", szBuffer);

static int
SubstituteFile(
    const char *substitutions,
    const char *filename)
{
    ...

	/*
	 * Run the substitutions over each line of the input
	 */

	while (fgets(szBuffer, cbBuffer, fp) != NULL) {
	    list_item_t *p = NULL;
	    for (p = substPtr; p != NULL; p = p->nextPtr) {
		char *m = strstr(szBuffer, p->key);
		if (m) {
		    char *cp, *op, *sp;
		    cp = szCopy;
		    op = szBuffer;
		    while (op != m) *cp++ = *op++;
		    sp = p->value;
		    while (sp && *sp) *cp++ = *sp++;
		    op += strlen(p->key);
		    while (*op) *cp++ = *op++;
		    *cp = 0;
		    memcpy(szBuffer, szCopy, sizeof(szCopy));
		}
	    }
	    printf(szBuffer); // Bug is here, szBuffer can be controlled
	}

	list_free(&substPtr);
    }
    fclose(fp);
    return 0;
}

This issue has been assigned a CVE number: CVE-2021-35331

See also https://sqlite.org/forum/forumpost/47c7eb6802. Let's repeat the conclusion here: "This Is Not A Tcl Vulnerability"! Same arguments as DRH wrote in the SQLite forum post.

That said, it's fixed here: [28ef6c0c741408a2]