d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* Fix a segfault when timed(8) receives a packet with a bad tsp_type.

Browse Source 
* Check that received packets aren't too short, as this could cause other
  problems.

Reviewed by:	imp, markm
This commit is contained in:
ben 2000-12-28 19:50:07 +00:00
parent a411a40492
commit c3d58d495a
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
usr.sbin/timed/timed/readmsg.c
View File

@ -88,6 +88,7 @@ readmsg(type, machfrom, intvl, netfrom)
struct tsplist *prev;
register struct netinfo *ntp;
register struct tsplist *ptr;
ssize_t n;
if (trace) {
fprintf(fd, "readmsg: looking for %s from %s, %s\n",
@ -206,11 +207,18 @@ readmsg(type, machfrom, intvl, netfrom)
continue;
}
length = sizeof(from);
if (recvfrom(sock, (char *)&msgin, sizeof(struct tsp), 0,
(struct sockaddr*)&from, &length) < 0) {
if ((n = recvfrom(sock, (char *)&msgin, sizeof(struct tsp), 0,
(struct sockaddr*)&from, &length)) < 0) {
syslog(LOG_ERR, "recvfrom: %m");
exit(1);
}
if (n < (ssize_t)sizeof(struct tsp)) {
syslog(LOG_NOTICE,
"short packet (%u/%u bytes) from %s",
n, sizeof(struct tsp),
inet_ntoa(from.sin_addr));
continue;
}
(void)gettimeofday(&from_when, (struct timezone *)0);
bytehostorder(&msgin);
@ -436,6 +444,13 @@ print(msg, addr)
{
char tm[26];
time_t tsp_time_sec;
if (msg->tsp_type >= TSPTYPENUMBER) {
fprintf(fd, "bad type (%u) on packet from %s\n",
msg->tsp_type, inet_ntoa(addr->sin_addr));
return;
}
switch (msg->tsp_type) {
case TSP_LOOP: