Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 11 Jul 2019 01:02:15 -0700
From:      Enji Cooper <yaneurabeya@gmail.com>
To:        Philip Paeps <philip@FreeBSD.org>
Cc:        src-committers <src-committers@freebsd.org>, svn-src-all <svn-src-all@freebsd.org>, svn-src-head@freebsd.org
Subject:   Re: svn commit: r349896 - head/contrib/telnet/telnet
Message-ID:  <6031EBD8-84D7-46D4-A3E5-D78427D084B1@gmail.com>
In-Reply-To: <201907102236.x6AMaFLI067550@repo.freebsd.org>
References:  <201907102236.x6AMaFLI067550@repo.freebsd.org>

next in thread | previous in thread | raw e-mail | index | archive | help

> On Jul 10, 2019, at 3:36 PM, Philip Paeps <philip@FreeBSD.org> wrote:
>=20
> Author: philip
> Date: Wed Jul 10 22:36:14 2019
> New Revision: 349896
> URL: https://svnweb.freebsd.org/changeset/base/349896
>=20
> Log:
>  telnet: fix minor style violation
>=20
>  While here also fix a very unlikely NULL pointer dereference.
>=20
>  Submitted by:	Shawn Webb <shawn.webb@hardenedbsd.org>
>=20
> Modified:
>  head/contrib/telnet/telnet/commands.c
>=20
> Modified: head/contrib/telnet/telnet/commands.c
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
> --- head/contrib/telnet/telnet/commands.c	Wed Jul 10 22:23:59 2019	=
(r349895)
> +++ head/contrib/telnet/telnet/commands.c	Wed Jul 10 22:36:14 2019	=
(r349896)
> @@ -45,6 +45,7 @@ __FBSDID("$FreeBSD$");
> #include <sys/socket.h>
> #include <netinet/in.h>
>=20
> +#include <assert.h>
> #include <ctype.h>
> #include <err.h>
> #include <errno.h>
> @@ -1654,11 +1655,13 @@ env_init(void)
> 		|| (strncmp((char *)ep->value, "unix:", 5) =3D=3D 0))) {
> 		char hbuf[256+1];
> 		char *cp2 =3D strchr((char *)ep->value, ':');
> +                size_t buflen;
>=20
> 		gethostname(hbuf, sizeof(hbuf));
> 		hbuf[sizeof(hbuf)-1] =3D '\0';
> -                unsigned int buflen =3D strlen(hbuf) + strlen(cp2) + =
1;
> + 		buflen =3D strlen(hbuf) + strlen(cp2) + 1;
> 		cp =3D (char *)malloc(sizeof(char)*buflen);
> +		assert(cp !=3D NULL);

This will unfortunately still segfault if assert is compiled out of the =
system as a no-op (-DNDEBUG).

I genuinely think using asprintf instead is the way to go, as Eitan and =
Warner brought up, since it reduces complexity in the program.

Thank you,
-Enji=



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6031EBD8-84D7-46D4-A3E5-D78427D084B1>