From owner-freebsd-audit  Thu Jan 25 22:24:45 2001
Delivered-To: freebsd-audit@freebsd.org
Received: from gratis.grondar.za (grouter.grondar.za [196.7.18.65])
	by hub.freebsd.org (Postfix) with ESMTP id A8D5137B69B
	for <FreeBSD-audit@FreeBSD.ORG>; Thu, 25 Jan 2001 22:24:24 -0800 (PST)
Received: from grondar.za (root@gratis.grondar.za [196.7.18.133])
	by gratis.grondar.za (8.11.1/8.11.1) with ESMTP id f0Q6NZW05123;
	Fri, 26 Jan 2001 08:24:08 +0200 (SAST)
	(envelope-from mark@grondar.za)
Message-Id: <200101260624.f0Q6NZW05123@gratis.grondar.za>
To: Mike Heffner <mheffner@vt.edu>
Cc: FreeBSD-audit <FreeBSD-audit@FreeBSD.ORG>
Subject: Re: lam(1) patch 
References: <XFMail.20010126005836.mheffner@vt.edu> 
In-Reply-To: <XFMail.20010126005836.mheffner@vt.edu> ; from Mike Heffner <mheffner@vt.edu>  "Fri, 26 Jan 2001 00:58:36 EST."
Date: Fri, 26 Jan 2001 08:23:47 +0200
From: Mark Murray <mark@grondar.za>
Sender: owner-freebsd-audit@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

> The following patch fixes the following:
> 
>  - sprintf() -> snprintf()
>  - manual (unbounded) while() loop string copying -> strlcpy()
>  - use tolower() rather than bit or'ing
>  - sanity check the user specified printf() format
>  - prevent walking off end of inputfile array
>  - some other string bounds issues
> 
> Reviews please?

Looks cool to me.

While you are in there, you probably also want to blow away the "register"
keyword(s) on the lines you are messing with.

M
-- 
Mark Murray
Warning: this .sig is umop ap!sdn


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-audit" in the body of the message