From owner-svn-src-stable@freebsd.org Tue Dec 6 18:52:19 2016 Return-Path: Delivered-To: svn-src-stable@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E34F9C6AA33; Tue, 6 Dec 2016 18:52:19 +0000 (UTC) (envelope-from glebius@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id A42C4BA; Tue, 6 Dec 2016 18:52:19 +0000 (UTC) (envelope-from glebius@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id uB6IqITs018209; Tue, 6 Dec 2016 18:52:18 GMT (envelope-from glebius@FreeBSD.org) Received: (from glebius@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id uB6IqIGa018208; Tue, 6 Dec 2016 18:52:18 GMT (envelope-from glebius@FreeBSD.org) Message-Id: <201612061852.uB6IqIGa018208@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: glebius set sender to glebius@FreeBSD.org using -f From: Gleb Smirnoff Date: Tue, 6 Dec 2016 18:52:18 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r309642 - stable/10/contrib/telnet/telnetd X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 18:52:20 -0000 Author: glebius Date: Tue Dec 6 18:52:18 2016 New Revision: 309642 URL: https://svnweb.freebsd.org/changeset/base/309642 Log: Merge r309638 from head: When telnetd(8) composes argument list for login(1), an unexpected sequence of memory allocation failures combined with insufficient error checking could result in the construction and execution of an argument sequence that was not intended. Fix that treating malloc(3) failures as fatal condition. Submitted by: brooks Security: FreeBSD-SA-16:36.telnetd Modified: stable/10/contrib/telnet/telnetd/sys_term.c Directory Properties: stable/10/ (props changed) Modified: stable/10/contrib/telnet/telnetd/sys_term.c ============================================================================== --- stable/10/contrib/telnet/telnetd/sys_term.c Tue Dec 6 18:52:02 2016 (r309641) +++ stable/10/contrib/telnet/telnetd/sys_term.c Tue Dec 6 18:52:18 2016 (r309642) @@ -1159,7 +1159,7 @@ addarg(char **argv, const char *val) */ argv = (char **)malloc(sizeof(*argv) * 12); if (argv == NULL) - return(NULL); + fatal(net, "failure allocating argument space"); *argv++ = (char *)10; *argv = (char *)0; } @@ -1170,11 +1170,12 @@ addarg(char **argv, const char *val) *argv = (char *)((long)(*argv) + 10); argv = (char **)realloc(argv, sizeof(*argv)*((long)(*argv) + 2)); if (argv == NULL) - return(NULL); + fatal(net, "failure allocating argument space"); argv++; cpp = &argv[(long)argv[-1] - 10]; } - *cpp++ = strdup(val); + if ((*cpp++ = strdup(val)) == NULL) + fatal(net, "failure allocating argument space"); *cpp = 0; return(argv); }