From owner-svn-src-all@freebsd.org Thu Jul 11 07:57:55 2019 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D14B215CA61A for ; Thu, 11 Jul 2019 07:57:55 +0000 (UTC) (envelope-from lists@eitanadler.com) Received: from mail-yb1-xb36.google.com (mail-yb1-xb36.google.com [IPv6:2607:f8b0:4864:20::b36]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 749DA6B43B for ; Thu, 11 Jul 2019 07:57:55 +0000 (UTC) (envelope-from lists@eitanadler.com) Received: by mail-yb1-xb36.google.com with SMTP id c202so548404ybf.0 for ; Thu, 11 Jul 2019 00:57:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=eitanadler.com; s=0xdeadbeef; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=UHis9ExlhtJ8Qh1gem2LPNGXL4WxSi65eb6HoqemXFk=; b=fvhf4rOiqMBbbTnJHP3uQ2QDzVIW+A59VRvwfOOxnaLpOKklR+18EKBAOxc0pDf2F4 V5KN7zmHdls8PMDk/f06hX+fPHfQITrgEWTEdnJMly6Gd4KQKbYMqVH4oDZu+AXscuWC fIADMDZVKYsYcYgKVh22KwWPcKzvP0BdYNOwI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=UHis9ExlhtJ8Qh1gem2LPNGXL4WxSi65eb6HoqemXFk=; b=LyUDTPUrr1NwN11wh/976+7gSfgRYrHLtQRMjgUYBzCsivUPbd4BRrW1dXrX2FqB7O CenSzqLZBSFD2YLlLUkn3VZ5pQ7GtRuKTjIP9XRLpbjFCW58fxWEhoWwvhg9YxR0626w GwVI+PUXNsZikjtQSNs9TVW4xUxNUr+M39GPcc4uMHngH9kV8cH91vP1Tifa3zPQy90N XEYbmMEie9y+uw91ZqpprDKsxw+jxZwGqcLmR7NvsVS5X0c6kSaf6pKMnL+oFi/Z6Ubv dbkGa+iEvZF5nOvX8GxGZhXfkQ9eRrFtazvM/f886OI3KGEKMFAVJVy3jSTPanZSPAzl UH/Q== X-Gm-Message-State: APjAAAWEMZTcXRK+FO1iDScXJk+0Nkk6UW9o0iJxsUvmDVnYX7+CsYXs BtVwgnscA+NI9WiG6uxbn9HsH5xAkdELdiQuKzVa0d40 X-Google-Smtp-Source: APXvYqzfOr8fA3VGDhSHsLPrqc/voU0Ktag2aoy2qVEViny9LGIblkXQTUuuyexamYeBCIyAc7N1Ri59lOI7dk7AYxE= X-Received: by 2002:a25:99c2:: with SMTP id q2mr1309536ybo.133.1562831874119; Thu, 11 Jul 2019 00:57:54 -0700 (PDT) MIME-Version: 1.0 References: <201907101742.x6AHg4os016752@repo.freebsd.org> In-Reply-To: <201907101742.x6AHg4os016752@repo.freebsd.org> From: Eitan Adler Date: Thu, 11 Jul 2019 00:57:27 -0700 Message-ID: Subject: Re: svn commit: r349890 - head/contrib/telnet/telnet To: Philip Paeps Cc: src-committers , svn-src-all@freebsd.org, svn-src-head@freebsd.org X-Rspamd-Queue-Id: 749DA6B43B X-Spamd-Bar: ------ Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-6.93 / 15.00]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; NEURAL_HAM_SHORT(-0.93)[-0.929,0]; REPLY(-4.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000,0] Content-Type: text/plain; charset="UTF-8" X-Content-Filtered-By: Mailman/MimeDel 2.1.29 X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Jul 2019 07:57:56 -0000 On Wed, 10 Jul 2019 at 10:42, Philip Paeps wrote: > Author: philip > Date: Wed Jul 10 17:42:04 2019 > New Revision: 349890 > URL: https://svnweb.freebsd.org/changeset/base/349890 > > Log: > telnet: fix a couple of snprintf() buffer overflows > > Obtained from: Juniper Networks > MFC after: 1 week > > Modified: > head/contrib/telnet/telnet/commands.c > head/contrib/telnet/telnet/telnet.c > head/contrib/telnet/telnet/utilities.c > > Modified: head/contrib/telnet/telnet/commands.c > > ============================================================================== > --- head/contrib/telnet/telnet/commands.c Wed Jul 10 17:21:59 2019 > (r349889) > +++ head/contrib/telnet/telnet/commands.c Wed Jul 10 17:42:04 2019 > (r349890) > @@ -1655,10 +1655,11 @@ env_init(void) > char hbuf[256+1]; > char *cp2 = strchr((char *)ep->value, ':'); > > - gethostname(hbuf, 256); > - hbuf[256] = '\0'; > - cp = (char *)malloc(strlen(hbuf) + strlen(cp2) + 1); > - sprintf((char *)cp, "%s%s", hbuf, cp2); > + gethostname(hbuf, sizeof(hbuf)); > + hbuf[sizeof(hbuf)-1] = '\0'; > + unsigned int buflen = strlen(hbuf) + strlen(cp2) + 1; > Shouldn't this be `size_t` ? > + cp = (char *)malloc(sizeof(char)*buflen); > sizeof(char) is always 1 and is odd to see. Don't cast the return value of `malloc`. > + snprintf((char *)cp, buflen, "%s%s", hbuf, cp2); > Is the cast of `cp` here required? Also couldn't this be replaced with asprintf? free(ep->value); > ep->value = (unsigned char *)cp; > } > > Modified: head/contrib/telnet/telnet/telnet.c > > ============================================================================== > --- head/contrib/telnet/telnet/telnet.c Wed Jul 10 17:21:59 2019 > (r349889) > +++ head/contrib/telnet/telnet/telnet.c Wed Jul 10 17:42:04 2019 > (r349890) > @@ -785,7 +785,7 @@ suboption(void) > name = gettermname(); > len = strlen(name) + 4 + 2; > if (len < NETROOM()) { > - sprintf(temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE, > + snprintf(temp, sizeof(temp), "%c%c%c%c%s%c%c", IAC, SB, > TELOPT_TTYPE, > TELQUAL_IS, name, IAC, SE); > ring_supply_data(&netoring, temp, len); > printsub('>', &temp[2], len-2); > @@ -807,7 +807,7 @@ suboption(void) > > TerminalSpeeds(&ispeed, &ospeed); > > - sprintf((char *)temp, "%c%c%c%c%ld,%ld%c%c", IAC, SB, > TELOPT_TSPEED, > + snprintf((char *)temp, sizeof(temp), "%c%c%c%c%ld,%ld%c%c", > IAC, SB, TELOPT_TSPEED, > TELQUAL_IS, ospeed, ispeed, IAC, SE); > len = strlen((char *)temp+4) + 4; /* temp[3] is 0 ... */ > > > Modified: head/contrib/telnet/telnet/utilities.c > > ============================================================================== > --- head/contrib/telnet/telnet/utilities.c Wed Jul 10 17:21:59 2019 > (r349889) > +++ head/contrib/telnet/telnet/utilities.c Wed Jul 10 17:42:04 2019 > (r349890) > @@ -629,7 +629,7 @@ printsub(char direction, unsigned char *pointer, int l > } > { > char tbuf[64]; > - sprintf(tbuf, "%s%s%s%s%s", > + snprintf(tbuf, sizeof(tbuf), "%s%s%s%s%s", > pointer[2]&MODE_EDIT ? "|EDIT" : "", > pointer[2]&MODE_TRAPSIG ? "|TRAPSIG" : "", > pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "", > > -- Eitan Adler