From owner-svn-src-head@freebsd.org Sun Jul 22 16:14:32 2018 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 14B91104F5A4; Sun, 22 Jul 2018 16:14:32 +0000 (UTC) (envelope-from asomers@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id B21C379FA5; Sun, 22 Jul 2018 16:14:31 +0000 (UTC) (envelope-from asomers@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 9053010475; Sun, 22 Jul 2018 16:14:31 +0000 (UTC) (envelope-from asomers@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w6MGEV4s034309; Sun, 22 Jul 2018 16:14:31 GMT (envelope-from asomers@FreeBSD.org) Received: (from asomers@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w6MGEUrb034306; Sun, 22 Jul 2018 16:14:30 GMT (envelope-from asomers@FreeBSD.org) Message-Id: <201807221614.w6MGEUrb034306@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: asomers set sender to asomers@FreeBSD.org using -f From: Alan Somers Date: Sun, 22 Jul 2018 16:14:30 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r336605 - head/libexec/tftpd X-SVN-Group: head X-SVN-Commit-Author: asomers X-SVN-Commit-Paths: head/libexec/tftpd X-SVN-Commit-Revision: 336605 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Jul 2018 16:14:32 -0000 Author: asomers Date: Sun Jul 22 16:14:30 2018 New Revision: 336605 URL: https://svnweb.freebsd.org/changeset/base/336605 Log: Fix multiple Coverity warnings in tftpd(8) * Initialize uninitialized variable (CID 1006502) * strcpy => strlcpy (CID 1006792, 1006791, 1006790) * Check function return values (CID 1009442, 1009441, 1009440) * Delete dead code in receive_packet (not reported by Coverity) * Remove redundant alarm(3) in receive_packet (not reported by Coverity) Reported by: Coverity CID: 1006502, 1006792, 1006791, 1006790, 1009442, 1009441, 1009440 MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D11287 Modified: head/libexec/tftpd/tftp-file.c head/libexec/tftpd/tftp-io.c head/libexec/tftpd/tftp-utils.c head/libexec/tftpd/tftpd.c Modified: head/libexec/tftpd/tftp-file.c ============================================================================== --- head/libexec/tftpd/tftp-file.c Sun Jul 22 14:11:52 2018 (r336604) +++ head/libexec/tftpd/tftp-file.c Sun Jul 22 16:14:30 2018 (r336605) @@ -36,6 +36,7 @@ __FBSDID("$FreeBSD$"); #include #include +#include #include #include #include @@ -80,7 +81,8 @@ convert_from_net(char *buffer, size_t count) if (buffer[i] == '\n') { if (n == 0) { if (ftell(file) != 0) { - fseek(file, -1, SEEK_END); + int r = fseek(file, -1, SEEK_END); + assert(r == 0); convbuffer[n++] = '\n'; } else { /* This shouldn't happen */ Modified: head/libexec/tftpd/tftp-io.c ============================================================================== --- head/libexec/tftpd/tftp-io.c Sun Jul 22 14:11:52 2018 (r336604) +++ head/libexec/tftpd/tftp-io.c Sun Jul 22 16:14:30 2018 (r336605) @@ -36,6 +36,7 @@ __FBSDID("$FreeBSD$"); #include #include +#include #include #include #include @@ -395,7 +396,7 @@ receive_packet(int peer, char *data, int size, struct struct sockaddr_storage *pfrom; socklen_t fromlen; int n; - static int waiting; + static int timed_out; if (debug&DEBUG_PACKETS) tftp_log(LOG_DEBUG, @@ -403,23 +404,16 @@ receive_packet(int peer, char *data, int size, struct pkt = (struct tftphdr *)data; - waiting = 0; signal(SIGALRM, timeout); - setjmp(timeoutbuf); + timed_out = setjmp(timeoutbuf); alarm(thistimeout); - if (waiting > 0) { - alarm(0); - return (RP_TIMEOUT); - } - - if (waiting > 0) { + if (timed_out != 0) { tftp_log(LOG_ERR, "receive_packet: timeout"); alarm(0); return (RP_TIMEOUT); } - waiting++; pfrom = (from == NULL) ? &from_local : from; fromlen = sizeof(*pfrom); n = recvfrom(peer, data, size, 0, (struct sockaddr *)pfrom, &fromlen); @@ -432,8 +426,6 @@ receive_packet(int peer, char *data, int size, struct tftp_log(LOG_ERR, "receive_packet: timeout"); return (RP_TIMEOUT); } - - alarm(0); if (n < 0) { /* No idea what could have happened if it isn't a timeout */ Modified: head/libexec/tftpd/tftp-utils.c ============================================================================== --- head/libexec/tftpd/tftp-utils.c Sun Jul 22 14:11:52 2018 (r336604) +++ head/libexec/tftpd/tftp-utils.c Sun Jul 22 16:14:30 2018 (r336605) @@ -270,11 +270,13 @@ char * rp_strerror(int error) { static char s[100]; + size_t space = sizeof(s); int i = 0; while (rp_errors[i].desc != NULL) { if (rp_errors[i].error == error) { - strcpy(s, rp_errors[i].desc); + strlcpy(s, rp_errors[i].desc, space); + space -= strlen(rp_errors[i].desc); } i++; } Modified: head/libexec/tftpd/tftpd.c ============================================================================== --- head/libexec/tftpd/tftpd.c Sun Jul 22 14:11:52 2018 (r336604) +++ head/libexec/tftpd/tftpd.c Sun Jul 22 16:14:30 2018 (r336605) @@ -374,7 +374,10 @@ main(int argc, char *argv[]) exit(1); } chdir("/"); - setgroups(1, &nobody->pw_gid); + if (setgroups(1, &nobody->pw_gid) != 0) { + tftp_log(LOG_ERR, "setgroups failed"); + exit(1); + } if (setuid(nobody->pw_uid) != 0) { tftp_log(LOG_ERR, "setuid failed"); exit(1); @@ -522,7 +525,7 @@ tftp_wrq(int peer, char *recvbuffer, ssize_t size) cp = parse_header(peer, recvbuffer, size, &filename, &mode); size -= (cp - recvbuffer) + 1; - strcpy(fnbuf, filename); + strlcpy(fnbuf, filename, sizeof(fnbuf)); reduce_path(fnbuf); filename = fnbuf; @@ -567,7 +570,7 @@ tftp_rrq(int peer, char *recvbuffer, ssize_t size) cp = parse_header(peer, recvbuffer, size, &filename, &mode); size -= (cp - recvbuffer) + 1; - strcpy(fnbuf, filename); + strlcpy(fnbuf, filename, sizeof(fnbuf)); reduce_path(fnbuf); filename = fnbuf; @@ -804,6 +807,7 @@ tftp_xmitfile(int peer, const char *mode) time_t now; struct tftp_stats ts; + memset(&ts, 0, sizeof(ts)); now = time(NULL); if (debug&DEBUG_SIMPLE) tftp_log(LOG_DEBUG, "Transmitting file");