Date: Mon, 27 Nov 2000 13:06:13 -0800 (PST) From: "Rodney W. Grimes" <freebsd@gndrsh.dnsmgr.net> To: kris@FreeBSD.org (Kris Kennaway) Cc: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/usr.sbin/cron/cron cron.h Message-ID: <200011272106.NAA37476@gndrsh.dnsmgr.net> In-Reply-To: <20001127124505.A65167@citusc17.usc.edu> from Kris Kennaway at "Nov 27, 2000 12:45:05 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
> On Mon, Nov 27, 2000 at 12:18:10PM -0800, Rodney W. Grimes wrote: > > > kris 2000/11/26 14:21:40 PST > > > > > > Modified files: > > > usr.sbin/cron/cron cron.h > > > Log: > > > Correct definition of MAXHOSTNAMELEN in ifdef'ed out code > > > > I actaully was ignoring these until it hit me, your actually probably > > breaking the purpose of these. Old systems that didn't have MAXHOSTNAMELEN > > defined in system headers had a 64 byte length for this. I suspect if one > > takes this code after your ``Correction'' and compiles it on one of these > > systems a buffer overflow condition could easily be triggered. > > I'm making the buffers larger, not smaller. Which is fine for old code returing values to new code, but new code passing values to old code is passing values longer than the old codes buffer. And that old code is probably riddled with strcpy's and such. > If ths code were to be compiled on a system which has the definition > of MAXHOSTNAMELEN in a nonstandard place (so it isn't #included by the > code) but it has a DNS resolver which is RFC-compliant and capable of > returning hostnames up to 255 octets long, then there would be a > buffer overflow when it tries to store the result in a 64-byte buffer. And conversely if it has an old non-compliant resolver passing it a 255 byte hostname is going to overflow the 64-byte buffer. > > I'd rather just see the ifdef'ed code removed so that the compile fails, > > rather than the compile working and the code failing in strange ways at > > run time. > > I thought about doing that, but it was easy to fix. The fix is not a fix, it actually breaks things that did work before :-(. Please just totally remove the ifndef/define/end block so that those of us who hall this code around to some very old boxen don't get bitten. Also from a code maintance standpoint having these scattered about the source tree is just asking for trouble some day, manifest constants should be defined in one place and one place only. -- Rod Grimes - KD7CAX @ CN85sl - (RWG25) rgrimes@gndrsh.dnsmgr.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200011272106.NAA37476>