From owner-freebsd-bugs@FreeBSD.ORG Thu Jan 8 13:20:02 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A44DB1065674 for ; Thu, 8 Jan 2009 13:20:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 80F088FC0C for ; Thu, 8 Jan 2009 13:20:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n08DK2tu097432 for ; Thu, 8 Jan 2009 13:20:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n08DK2wj097431; Thu, 8 Jan 2009 13:20:02 GMT (envelope-from gnats) Resent-Date: Thu, 8 Jan 2009 13:20:02 GMT Resent-Message-Id: <200901081320.n08DK2wj097431@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Yonggang Li Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 02FB21065675 for ; Thu, 8 Jan 2009 13:18:47 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id E4CC98FC19 for ; Thu, 8 Jan 2009 13:18:46 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n08DIks6021839 for ; Thu, 8 Jan 2009 13:18:46 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id n08DIkuj021838; Thu, 8 Jan 2009 13:18:46 GMT (envelope-from nobody) Message-Id: <200901081318.n08DIkuj021838@www.freebsd.org> Date: Thu, 8 Jan 2009 13:18:46 GMT From: Yonggang Li To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: bin/130300: netstat crash when params is incorrect X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Jan 2009 13:20:02 -0000 >Number: 130300 >Category: bin >Synopsis: netstat crash when params is incorrect >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Thu Jan 08 13:20:02 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Yonggang Li >Release: 7.0 Release >Organization: >Environment: FreeBSD freebsd.dlink-li 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Sun Feb 24 19:59:52 UTC 2008 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 >Description: netstat crash when input: netstat -m XXX XXX means any string. >How-To-Repeat: refer to Full Description. >Fix: it is caused by the code in /usr/src/usr.bin/netstat/main.c: main function #define BACKWARD_COMPATIBILITY #ifdef BACKWARD_COMPATIBILITY if (*argv) { if (isdigit(**argv)) { interval = atoi(*argv); if (interval <= 0) usage(); ++argv; iflag = 1; } if (*argv) { nlistf = *argv; if (*++argv) memf = *argv; } } #endif this backward_compatibility code can not recognize the incorrect params, but the internal flags(nlistf,memf) are set incorrectly instead. And if this code is obsolete, I suggest delete this code and add params check. Patch attached with submission follows: *** main.c Tue Jan 6 15:01:25 2009 --- ../main.c Thu Jan 8 13:16:43 2009 *************** *** 465,489 **** } argv += optind; argc -= optind; ! ! #define BACKWARD_COMPATIBILITY ! #ifdef BACKWARD_COMPATIBILITY ! if (*argv) { ! if (isdigit(**argv)) { ! interval = atoi(*argv); ! if (interval <= 0) ! usage(); ! ++argv; ! iflag = 1; ! } ! if (*argv) { ! nlistf = *argv; ! if (*++argv) ! memf = *argv; ! } ! } ! #endif ! /* * Discard setgid privileges if not the running kernel so that bad * guys can't print interesting stuff from kernel memory. --- 465,475 ---- } argv += optind; argc -= optind; ! /* ! * Params should be parsed without error. ! * */ ! if(argv) ! usage(); /* * Discard setgid privileges if not the running kernel so that bad * guys can't print interesting stuff from kernel memory. >Release-Note: >Audit-Trail: >Unformatted: