DIA file name handling format string

Author : KaDaL-X

Software tested
Dia v 0.94 on fedora Core 4
Dia v 0.94 on Mandriva

PoC :
[ph03n1x@kaiten ~]$ touch %p%p%p%p.bmp

Now, open %p%p%p%p.bmp using dia then error something like this will happen

Failed to load:
Couldn't recognize the image file format for file

Code analisys:
in plug-ins/pixbuf/pixbuf.c line 152

else if (error) /* otherwise a pixbuf misbehaviour */
message_warning ("Failed to load:\n%s", error->message);
g_error_free (error);

then in lib/message.c line 220

message_warning(const char *format, ...)
va_list args, args2;

va_start (args, format);
va_start (args2, format);
message_internal(_("Warning"), format, &args, &args2);
va_end (args);
va_end (args2);

On lib/message.c line 187 message_internal has been defined as

static MessageInternal message_internal = gtk_message_internal;

Now, analizyng gtk_message_internal() function on lib/message.c on line
vsprintf() function was used incorrectly

vsprintf (buf, fmt, *args2);

The second argument of vsprintf must be a constant string, based on

Relevant Pages