User: james
Date: 06/08/11 19:37:18
Modified: xemacs/lib-src ChangeLog gnuslib.c gnuclient.c
Log:
Prevent potential buffer overflows. Also enable use of shutdown() on linux.
<m37j1jez4n.fsf(a)jerrypc.cs.usu.edu>
Revision Changes Path
1.213 +10 -0 XEmacs/xemacs/lib-src/ChangeLog
Index: ChangeLog
===================================================================
RCS file: /pack/xemacscvs/XEmacs/xemacs/lib-src/ChangeLog,v
retrieving revision 1.212
retrieving revision 1.213
diff -u -p -r1.212 -r1.213
--- ChangeLog 2006/07/25 04:46:41 1.212
+++ ChangeLog 2006/08/11 17:37:17 1.213
@@ -1,3 +1,13 @@
+2006-08-08 Jerry James <james(a)xemacs.org>
+
+ * gnuslib.c (disconnect_from_server): shutdown() has been fine on
+ Linux for a long time now; use it. Also, don't use length to
+ access the buffer unless it is positive, not just nonzero.
+ * gnuclient.c (filename_expand): Initialize the last array element
+ to get a valid C string in case of overflow. Use strncat to avoid
+ buffer overruns.
+ * gnuclient.c (main): Use strncpy to avoid buffer overruns.
+
2006-07-21 Stephen J. Turnbull <stephen(a)xemacs.org>
* etags.c: Xemacs -> XEmacs.
1.13 +5 -7 XEmacs/xemacs/lib-src/gnuslib.c
Index: gnuslib.c
===================================================================
RCS file: /pack/xemacscvs/XEmacs/xemacs/lib-src/gnuslib.c,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -p -r1.12 -r1.13
--- gnuslib.c 2001/08/13 04:45:48 1.12
+++ gnuslib.c 2006/08/11 17:37:17 1.13
@@ -409,13 +409,11 @@ disconnect_from_server (int s, int echo)
send_string(s,EOT_STR); /* make sure server gets string */
-#if !defined (linux) && !defined (_SCO_DS)
+#ifndef _SCO_DS
/*
- * shutdown is completely hozed under linux. If s is a unix domain socket,
- * you'll get EOPNOTSUPP back from it. If s is an internet socket, you get
- * a broken pipe when you try to read a bit later. The latter
- * problem is fixed for linux versions >= 1.1.46, but the problem
- * with unix sockets persists. Sigh.
+ * There used to be a comment here complaining about ancient Linux
+ * versions. It is no longer relevant. I don't know why _SCO_DS is
+ * verboten here, as the original comment did not say.
*/
if (shutdown(s,1) == -1) {
@@ -434,7 +432,7 @@ disconnect_from_server (int s, int echo)
#else
while ((length = read(s,buffer,GSERV_BUFSZ)) > 0 ||
(length == -1 && errno == EINTR)) {
- if (length) {
+ if (length > 0) {
buffer[length] = '\0';
if (echo) {
fputs(buffer,stdout);
1.28 +13 -10 XEmacs/xemacs/lib-src/gnuclient.c
Index: gnuclient.c
===================================================================
RCS file: /pack/xemacscvs/XEmacs/xemacs/lib-src/gnuclient.c,v
retrieving revision 1.27
retrieving revision 1.28
diff -u -p -r1.27 -r1.28
--- gnuclient.c 2004/12/06 23:23:41 1.27
+++ gnuclient.c 2006/08/11 17:37:18 1.28
@@ -187,7 +187,7 @@ filename_expand (char *fullpath, char *f
#endif
int len;
- fullpath[0] = '\0';
+ fullpath[0] = fullpath[QXE_PATH_MAX] = '\0';
#ifdef CYGWIN
/*
@@ -200,7 +200,7 @@ filename_expand (char *fullpath, char *f
if (filename[0] && filename[0] == '/')
{
/* Absolute (unix-style) pathname. Do nothing */
- strcat (fullpath, filename);
+ strncat (fullpath, filename, QXE_PATH_MAX);
}
else
{
@@ -208,15 +208,18 @@ filename_expand (char *fullpath, char *f
and prepend it. FIXME: need to fix the case of DOS paths like
"\foo", where we need to get the current drive. */
- strcat (fullpath, get_current_working_directory ());
+ strncat (fullpath, get_current_working_directory (), QXE_PATH_MAX);
len = strlen (fullpath);
- if (len > 0 && fullpath[len-1] == '/') /* trailing slash already? */
- ; /* yep */
- else
- strcat (fullpath, "/"); /* nope, append trailing slash */
+ /* If no trailing slash, add one */
+ if (len <= 0 || (fullpath[len - 1] != '/' && len < QXE_PATH_MAX))
+ {
+ strcat (fullpath, "/");
+ len++;
+ }
+
/* Don't forget to add the filename! */
- strcat (fullpath,filename);
+ strncat (fullpath, filename, QXE_PATH_MAX - len);
}
} /* filename_expand */
@@ -435,7 +438,7 @@ main (int argc, char *argv[])
break;
case 'r':
GET_ARGUMENT (remotearg, "-r");
- strcpy (remotepath, remotearg);
+ strncpy (remotepath, remotearg, QXE_PATH_MAX);
rflg = 1;
break;
#endif /* INTERNET_DOMAIN_SOCKETS */
@@ -590,7 +593,7 @@ main (int argc, char *argv[])
* to this machine */
if ((ptr = getenv ("GNU_NODE")) != NULL)
/* user specified a path */
- strcpy (remotepath, ptr);
+ strncpy (remotepath, ptr, QXE_PATH_MAX);
}
#if 0 /* This is really bogus... re-enable it if you must have it! */
#if defined (hp9000s300) || defined (hp9000s800)