Date: Thu, 8 Jan 2009 13:18:46 GMT From: Yonggang Li <leeygang@gmail.com> To: freebsd-gnats-submit@FreeBSD.org Subject: bin/130300: netstat crash when params is incorrect Message-ID: <200901081318.n08DIkuj021838@www.freebsd.org> Resent-Message-ID: <200901081320.n08DK2wj097431@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 130300
>Category: bin
>Synopsis: netstat crash when params is incorrect
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Thu Jan 08 13:20:02 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator: Yonggang Li
>Release: 7.0 Release
>Organization:
>Environment:
FreeBSD freebsd.dlink-li 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Sun Feb 24 19:59:52 UTC 2008 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386
>Description:
netstat crash when input:
netstat -m XXX
XXX means any string.
>How-To-Repeat:
refer to Full Description.
>Fix:
it is caused by the code in /usr/src/usr.bin/netstat/main.c: main function
#define BACKWARD_COMPATIBILITY
#ifdef BACKWARD_COMPATIBILITY
if (*argv) {
if (isdigit(**argv)) {
interval = atoi(*argv);
if (interval <= 0)
usage();
++argv;
iflag = 1;
}
if (*argv) {
nlistf = *argv;
if (*++argv)
memf = *argv;
}
}
#endif
this backward_compatibility code can not recognize the incorrect params, but the internal flags(nlistf,memf) are set incorrectly instead.
And if this code is obsolete, I suggest delete this code and add params check.
Patch attached with submission follows:
*** main.c Tue Jan 6 15:01:25 2009
--- ../main.c Thu Jan 8 13:16:43 2009
***************
*** 465,489 ****
}
argv += optind;
argc -= optind;
!
! #define BACKWARD_COMPATIBILITY
! #ifdef BACKWARD_COMPATIBILITY
! if (*argv) {
! if (isdigit(**argv)) {
! interval = atoi(*argv);
! if (interval <= 0)
! usage();
! ++argv;
! iflag = 1;
! }
! if (*argv) {
! nlistf = *argv;
! if (*++argv)
! memf = *argv;
! }
! }
! #endif
!
/*
* Discard setgid privileges if not the running kernel so that bad
* guys can't print interesting stuff from kernel memory.
--- 465,475 ----
}
argv += optind;
argc -= optind;
! /*
! * Params should be parsed without error.
! * */
! if(argv)
! usage();
/*
* Discard setgid privileges if not the running kernel so that bad
* guys can't print interesting stuff from kernel memory.
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200901081318.n08DIkuj021838>