3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
65 lines
1.7 KiB
Diff
65 lines
1.7 KiB
Diff
Index: readmsg.c
|
|
===================================================================
|
|
RCS file: /mnt/ncvs/src/usr.sbin/timed/timed/readmsg.c,v
|
|
retrieving revision 1.5
|
|
retrieving revision 1.7
|
|
diff -u -r1.5 -r1.7
|
|
--- readmsg.c 1999/08/28 01:20:18 1.5
|
|
+++ readmsg.c 2001/01/01 18:43:21 1.7
|
|
@@ -88,6 +88,7 @@
|
|
struct tsplist *prev;
|
|
register struct netinfo *ntp;
|
|
register struct tsplist *ptr;
|
|
+ ssize_t n;
|
|
|
|
if (trace) {
|
|
fprintf(fd, "readmsg: looking for %s from %s, %s\n",
|
|
@@ -206,11 +207,18 @@
|
|
continue;
|
|
}
|
|
length = sizeof(from);
|
|
- if (recvfrom(sock, (char *)&msgin, sizeof(struct tsp), 0,
|
|
- (struct sockaddr*)&from, &length) < 0) {
|
|
+ if ((n = recvfrom(sock, (char *)&msgin, sizeof(struct tsp), 0,
|
|
+ (struct sockaddr*)&from, &length)) < 0) {
|
|
syslog(LOG_ERR, "recvfrom: %m");
|
|
exit(1);
|
|
}
|
|
+ if (n < (ssize_t)sizeof(struct tsp)) {
|
|
+ syslog(LOG_NOTICE,
|
|
+ "short packet (%u/%u bytes) from %s",
|
|
+ n, sizeof(struct tsp),
|
|
+ inet_ntoa(from.sin_addr));
|
|
+ continue;
|
|
+ }
|
|
(void)gettimeofday(&from_when, (struct timezone *)0);
|
|
bytehostorder(&msgin);
|
|
|
|
@@ -222,6 +230,13 @@
|
|
continue;
|
|
}
|
|
|
|
+ if (memchr(msgin.tsp_name,
|
|
+ '\0', sizeof msgin.tsp_name) == NULL) {
|
|
+ syslog(LOG_NOTICE, "hostname field not NUL terminated "
|
|
+ "in packet from %s", inet_ntoa(from.sin_addr));
|
|
+ continue;
|
|
+ }
|
|
+
|
|
fromnet = NULL;
|
|
for (ntp = nettab; ntp != NULL; ntp = ntp->next)
|
|
if ((ntp->mask & from.sin_addr.s_addr) ==
|
|
@@ -436,6 +451,13 @@
|
|
{
|
|
char tm[26];
|
|
time_t tsp_time_sec;
|
|
+
|
|
+ if (msg->tsp_type >= TSPTYPENUMBER) {
|
|
+ fprintf(fd, "bad type (%u) on packet from %s\n",
|
|
+ msg->tsp_type, inet_ntoa(addr->sin_addr));
|
|
+ return;
|
|
+ }
|
|
+
|
|
switch (msg->tsp_type) {
|
|
|
|
case TSP_LOOP:
|