Date: Fri, 20 Jul 2001 05:02:30 -0700 (PDT) From: Ruslan Ermilov <ru@FreeBSD.org> To: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/crypto/telnet/telnetd ext.h slc.c state.c utility.c Message-ID: <200107201202.f6KC2U389652@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
ru 2001/07/20 05:02:30 PDT
Modified files:
crypto/telnet/telnetd ext.h slc.c state.c utility.c
Log:
More potential buffer overflow fixes.
o Fixed `nfrontp' calculations in output_data(). If `remaining' is
initially zero, it was possible for `nfrontp' to be decremented.
Noticed by: dillon
o Replaced leaking writenet() with output_datalen():
: * writenet
: *
: * Just a handy little function to write a bit of raw data to the net.
: * It will force a transmit of the buffer if necessary
: *
: * arguments
: * ptr - A pointer to a character string to write
: * len - How many bytes to write
: */
: void
: writenet(ptr, len)
: register unsigned char *ptr;
: register int len;
: {
: /* flush buffer if no room for new data) */
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
: if ((&netobuf[BUFSIZ] - nfrontp) < len) {
: /* if this fails, don't worry, buffer is a little big */
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
: netflush();
: }
:
: memmove(nfrontp, ptr, len);
: nfrontp += len;
:
: } /* end of writenet */
What an irony! :-)
o Optimized output_datalen() a bit.
Revision Changes Path
1.6 +3 -4 src/crypto/telnet/telnetd/ext.h
1.6 +2 -2 src/crypto/telnet/telnetd/slc.c
1.8 +5 -5 src/crypto/telnet/telnetd/state.c
1.9 +1 -28 src/crypto/telnet/telnetd/utility.c
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200107201202.f6KC2U389652>