d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Yet another buffer overflow.

Browse Source 
2.2 candidate
(and -stable too actually, who does that?)
Reviewed by:	Warner Losh
This commit is contained in:
Guido van Rooij 1997-01-01 14:08:47 +00:00
parent d20f8f693b
commit 6412184028
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=21174
4 changed files with 19 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sbin/restore/extern.h
View File

@ -36,7 +36,7 @@
struct entry *addentry __P((char *, ino_t, int));
long addfile __P((char *, ino_t, int));
void badentry __P((struct entry *, char *));
void canon __P((char *, char *));
void canon __P((char *, char *, int));
void checkrestore __P((void));
void closemt __P((void));
void createfiles __P((void));

14
sbin/restore/interactive.c
View File

@ -109,7 +109,7 @@ runcmdshell()
arglist.glob.gl_closedir = (void *)rst_closedir;
arglist.glob.gl_lstat = glob_stat;
arglist.glob.gl_stat = glob_stat;
canon("/", curdir);
canon("/", curdir, sizeof(curdir));
loop:
if (setjmp(reset) != 0) {
if (arglist.freeglob != 0) {
@ -357,7 +357,7 @@ getcmd(curdir, cmd, name, ap)
* If it is an absolute pathname, canonicalize it and return it.
*/
if (rawname[0] == '/') {
canon(rawname, name);
canon(rawname, name, sizeof(name));
} else {
/*
* For relative pathnames, prepend the current directory to
@ -366,7 +366,7 @@ getcmd(curdir, cmd, name, ap)
(void) strcpy(output, curdir);
(void) strcat(output, "/");
(void) strcat(output, rawname);
canon(output, name);
canon(output, name, sizeof(name));
}
if (glob(name, GLOB_ALTDIRFUNC, NULL, &ap->glob) < 0)
fprintf(stderr, "%s: out of memory\n", ap->cmd);
@ -438,8 +438,9 @@ copynext(input, output)
* remove any imbedded "." and ".." components.
*/
void
canon(rawname, canonname)
canon(rawname, canonname, len)
char *rawname, *canonname;
int len;
{
register char *cp, *np;
@ -449,6 +450,11 @@ canon(rawname, canonname)
(void) strcpy(canonname, ".");
else
(void) strcpy(canonname, "./");
if (strlen(canonname) + strlen(rawname) >= len) {
fprintf(stderr, "canonname: not enough bufferspace\n");
done(1);
}
(void) strcat(canonname, rawname);
/*
* Eliminate multiple and trailing '/'s

4
sbin/restore/main.c
View File

@ -239,7 +239,7 @@ main(argc, argv)
extractdirs(0);
initsymtable((char *)0);
while (argc--) {
canon(*argv++, name);
canon(*argv++, name, sizeof(name));
ino = dirlookup(name);
if (ino == 0)
continue;
@ -254,7 +254,7 @@ main(argc, argv)
extractdirs(1);
initsymtable((char *)0);
while (argc--) {
canon(*argv++, name);
canon(*argv++, name, sizeof(name));
ino = dirlookup(name);
if (ino == 0)
continue;

8
sbin/restore/tape.c
View File

@ -63,7 +63,7 @@ static char sccsid[] = "@(#)tape.c 8.3 (Berkeley) 4/1/94";
static long fssize = MAXBSIZE;
static int mt = -1;
static int pipein = 0;
static char magtape[BUFSIZ];
static char *magtape;
static int blkcnt;
static int numtrec;
static char *tapebuf;
@ -146,7 +146,11 @@ setinput(source)
pipein++;
}
setuid(getuid()); /* no longer need or want root privileges */
(void) strcpy(magtape, source);
magtape = strdup(source);
if (magtape == NULL) {
fprintf(stderr, "Cannot allocate space for magtape buffer\n");
done(1);
}
}
void