FreeBSD Mail Archives

Date:      Wed, 24 Jul 2019 12:51:52 +0000 (UTC)
From:      Gordon Tetlow <gordon@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org
Subject:   svn commit: r350281 - in releng: 11.2/contrib/telnet/telnet 11.3/contrib/telnet/telnet 12.0/contrib/telnet/telnet
Message-ID:  <201907241251.x6OCpqHo072277@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help

Author: gordon
Date: Wed Jul 24 12:51:52 2019
New Revision: 350281
URL: https://svnweb.freebsd.org/changeset/base/350281

Log:
  Fix multiple telnet client vulnerabilities.
  
  Approved by:	so
  Security:	FreeBSD-SA-19:12.telnet
  Security:	CVE-2019-0053

Modified:
  releng/11.2/contrib/telnet/telnet/commands.c
  releng/11.2/contrib/telnet/telnet/telnet.c
  releng/11.2/contrib/telnet/telnet/utilities.c
  releng/11.3/contrib/telnet/telnet/commands.c
  releng/11.3/contrib/telnet/telnet/telnet.c
  releng/11.3/contrib/telnet/telnet/utilities.c
  releng/12.0/contrib/telnet/telnet/commands.c
  releng/12.0/contrib/telnet/telnet/telnet.c
  releng/12.0/contrib/telnet/telnet/utilities.c

Modified: releng/11.2/contrib/telnet/telnet/commands.c
==============================================================================
--- releng/11.2/contrib/telnet/telnet/commands.c	Wed Jul 24 12:50:46 2019	(r350280)
+++ releng/11.2/contrib/telnet/telnet/commands.c	Wed Jul 24 12:51:52 2019	(r350281)
@@ -45,6 +45,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/socket.h>
 #include <netinet/in.h>
 
+#include <assert.h>
 #include <ctype.h>
 #include <err.h>
 #include <errno.h>
@@ -1654,11 +1655,14 @@ env_init(void)
 		|| (strncmp((char *)ep->value, "unix:", 5) == 0))) {
 		char hbuf[256+1];
 		char *cp2 = strchr((char *)ep->value, ':');
+                size_t buflen;
 
-		gethostname(hbuf, 256);
-		hbuf[256] = '\0';
-		cp = (char *)malloc(strlen(hbuf) + strlen(cp2) + 1);
-		sprintf((char *)cp, "%s%s", hbuf, cp2);
+		gethostname(hbuf, sizeof(hbuf));
+		hbuf[sizeof(hbuf)-1] = '\0';
+ 		buflen = strlen(hbuf) + strlen(cp2) + 1;
+		cp = (char *)malloc(sizeof(char)*buflen);
+		assert(cp != NULL);
+		snprintf((char *)cp, buflen, "%s%s", hbuf, cp2);
 		free(ep->value);
 		ep->value = (unsigned char *)cp;
 	}

Modified: releng/11.2/contrib/telnet/telnet/telnet.c
==============================================================================
--- releng/11.2/contrib/telnet/telnet/telnet.c	Wed Jul 24 12:50:46 2019	(r350280)
+++ releng/11.2/contrib/telnet/telnet/telnet.c	Wed Jul 24 12:51:52 2019	(r350281)
@@ -785,7 +785,7 @@ suboption(void)
 	    name = gettermname();
 	    len = strlen(name) + 4 + 2;
 	    if (len < NETROOM()) {
-		sprintf(temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
+		snprintf(temp, sizeof(temp), "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
 				TELQUAL_IS, name, IAC, SE);
 		ring_supply_data(&netoring, temp, len);
 		printsub('>', &temp[2], len-2);
@@ -807,7 +807,7 @@ suboption(void)
 
 	    TerminalSpeeds(&ispeed, &ospeed);
 
-	    sprintf((char *)temp, "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
+	    snprintf((char *)temp, sizeof(temp), "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
 		    TELQUAL_IS, ospeed, ispeed, IAC, SE);
 	    len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */
 

Modified: releng/11.2/contrib/telnet/telnet/utilities.c
==============================================================================
--- releng/11.2/contrib/telnet/telnet/utilities.c	Wed Jul 24 12:50:46 2019	(r350280)
+++ releng/11.2/contrib/telnet/telnet/utilities.c	Wed Jul 24 12:51:52 2019	(r350281)
@@ -629,7 +629,7 @@ printsub(char direction, unsigned char *pointer, int l
 		}
 		{
 		    char tbuf[64];
-		    sprintf(tbuf, "%s%s%s%s%s",
+		    snprintf(tbuf, sizeof(tbuf), "%s%s%s%s%s",
 			pointer[2]&MODE_EDIT ? "|EDIT" : "",
 			pointer[2]&MODE_TRAPSIG ? "|TRAPSIG" : "",
 			pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",

Modified: releng/11.3/contrib/telnet/telnet/commands.c
==============================================================================
--- releng/11.3/contrib/telnet/telnet/commands.c	Wed Jul 24 12:50:46 2019	(r350280)
+++ releng/11.3/contrib/telnet/telnet/commands.c	Wed Jul 24 12:51:52 2019	(r350281)
@@ -45,6 +45,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/socket.h>
 #include <netinet/in.h>
 
+#include <assert.h>
 #include <ctype.h>
 #include <err.h>
 #include <errno.h>
@@ -1654,11 +1655,14 @@ env_init(void)
 		|| (strncmp((char *)ep->value, "unix:", 5) == 0))) {
 		char hbuf[256+1];
 		char *cp2 = strchr((char *)ep->value, ':');
+                size_t buflen;
 
-		gethostname(hbuf, 256);
-		hbuf[256] = '\0';
-		cp = (char *)malloc(strlen(hbuf) + strlen(cp2) + 1);
-		sprintf((char *)cp, "%s%s", hbuf, cp2);
+		gethostname(hbuf, sizeof(hbuf));
+		hbuf[sizeof(hbuf)-1] = '\0';
+ 		buflen = strlen(hbuf) + strlen(cp2) + 1;
+		cp = (char *)malloc(sizeof(char)*buflen);
+		assert(cp != NULL);
+		snprintf((char *)cp, buflen, "%s%s", hbuf, cp2);
 		free(ep->value);
 		ep->value = (unsigned char *)cp;
 	}

Modified: releng/11.3/contrib/telnet/telnet/telnet.c
==============================================================================
--- releng/11.3/contrib/telnet/telnet/telnet.c	Wed Jul 24 12:50:46 2019	(r350280)
+++ releng/11.3/contrib/telnet/telnet/telnet.c	Wed Jul 24 12:51:52 2019	(r350281)
@@ -785,7 +785,7 @@ suboption(void)
 	    name = gettermname();
 	    len = strlen(name) + 4 + 2;
 	    if (len < NETROOM()) {
-		sprintf(temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
+		snprintf(temp, sizeof(temp), "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
 				TELQUAL_IS, name, IAC, SE);
 		ring_supply_data(&netoring, temp, len);
 		printsub('>', &temp[2], len-2);
@@ -807,7 +807,7 @@ suboption(void)
 
 	    TerminalSpeeds(&ispeed, &ospeed);
 
-	    sprintf((char *)temp, "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
+	    snprintf((char *)temp, sizeof(temp), "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
 		    TELQUAL_IS, ospeed, ispeed, IAC, SE);
 	    len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */
 

Modified: releng/11.3/contrib/telnet/telnet/utilities.c
==============================================================================
--- releng/11.3/contrib/telnet/telnet/utilities.c	Wed Jul 24 12:50:46 2019	(r350280)
+++ releng/11.3/contrib/telnet/telnet/utilities.c	Wed Jul 24 12:51:52 2019	(r350281)
@@ -629,7 +629,7 @@ printsub(char direction, unsigned char *pointer, int l
 		}
 		{
 		    char tbuf[64];
-		    sprintf(tbuf, "%s%s%s%s%s",
+		    snprintf(tbuf, sizeof(tbuf), "%s%s%s%s%s",
 			pointer[2]&MODE_EDIT ? "|EDIT" : "",
 			pointer[2]&MODE_TRAPSIG ? "|TRAPSIG" : "",
 			pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",

Modified: releng/12.0/contrib/telnet/telnet/commands.c
==============================================================================
--- releng/12.0/contrib/telnet/telnet/commands.c	Wed Jul 24 12:50:46 2019	(r350280)
+++ releng/12.0/contrib/telnet/telnet/commands.c	Wed Jul 24 12:51:52 2019	(r350281)
@@ -45,6 +45,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/socket.h>
 #include <netinet/in.h>
 
+#include <assert.h>
 #include <ctype.h>
 #include <err.h>
 #include <errno.h>
@@ -1654,11 +1655,14 @@ env_init(void)
 		|| (strncmp((char *)ep->value, "unix:", 5) == 0))) {
 		char hbuf[256+1];
 		char *cp2 = strchr((char *)ep->value, ':');
+                size_t buflen;
 
-		gethostname(hbuf, 256);
-		hbuf[256] = '\0';
-		cp = (char *)malloc(strlen(hbuf) + strlen(cp2) + 1);
-		sprintf((char *)cp, "%s%s", hbuf, cp2);
+		gethostname(hbuf, sizeof(hbuf));
+		hbuf[sizeof(hbuf)-1] = '\0';
+ 		buflen = strlen(hbuf) + strlen(cp2) + 1;
+		cp = (char *)malloc(sizeof(char)*buflen);
+		assert(cp != NULL);
+		snprintf((char *)cp, buflen, "%s%s", hbuf, cp2);
 		free(ep->value);
 		ep->value = (unsigned char *)cp;
 	}

Modified: releng/12.0/contrib/telnet/telnet/telnet.c
==============================================================================
--- releng/12.0/contrib/telnet/telnet/telnet.c	Wed Jul 24 12:50:46 2019	(r350280)
+++ releng/12.0/contrib/telnet/telnet/telnet.c	Wed Jul 24 12:51:52 2019	(r350281)
@@ -785,7 +785,7 @@ suboption(void)
 	    name = gettermname();
 	    len = strlen(name) + 4 + 2;
 	    if (len < NETROOM()) {
-		sprintf(temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
+		snprintf(temp, sizeof(temp), "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
 				TELQUAL_IS, name, IAC, SE);
 		ring_supply_data(&netoring, temp, len);
 		printsub('>', &temp[2], len-2);
@@ -807,7 +807,7 @@ suboption(void)
 
 	    TerminalSpeeds(&ispeed, &ospeed);
 
-	    sprintf((char *)temp, "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
+	    snprintf((char *)temp, sizeof(temp), "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
 		    TELQUAL_IS, ospeed, ispeed, IAC, SE);
 	    len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */
 

Modified: releng/12.0/contrib/telnet/telnet/utilities.c
==============================================================================
--- releng/12.0/contrib/telnet/telnet/utilities.c	Wed Jul 24 12:50:46 2019	(r350280)
+++ releng/12.0/contrib/telnet/telnet/utilities.c	Wed Jul 24 12:51:52 2019	(r350281)
@@ -629,7 +629,7 @@ printsub(char direction, unsigned char *pointer, int l
 		}
 		{
 		    char tbuf[64];
-		    sprintf(tbuf, "%s%s%s%s%s",
+		    snprintf(tbuf, sizeof(tbuf), "%s%s%s%s%s",
 			pointer[2]&MODE_EDIT ? "|EDIT" : "",
 			pointer[2]&MODE_TRAPSIG ? "|TRAPSIG" : "",
 			pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201907241251.x6OCpqHo072277>

Header And Logo

Peripheral Links

Site Navigation

Header And Logo

Peripheral Links

Search

Site Navigation