Backport of Olaf's buffer overflow fixes.

diff --git a/etc/papd/main.c b/etc/papd/main.c
index 5ef7e65b32b0107d81a570bf90cc69a80fac3784..787aa7daa5cebd0651585094b8c8ccd5d65a1063 100644 (file)
--- a/etc/papd/main.c
+++ b/etc/papd/main.c
@@ -1,5 +1,5 @@
 /*
 /*

- * $Id: main.c,v 1.13.2.1 2002-03-12 15:44:38 srittau Exp $
+ * $Id: main.c,v 1.13.2.2 2002-08-20 20:42:24 srittau Exp $

  *
  * Copyright (c) 1990,1995 Regents of The University of Michigan.
  * All Rights Reserved.  See COPYRIGHT.
  *
  * Copyright (c) 1990,1995 Regents of The University of Michigan.
  * All Rights Reserved.  See COPYRIGHT.


@@ -94,7 +94,7 @@ char          *uampath = _PATH_PAPDUAMPATH;
 /* Prototypes for locally used functions */
 int getstatus( struct printer *pr, char *buf );
 int rprintcap( struct printer *pr );
 /* Prototypes for locally used functions */
 int getstatus( struct printer *pr, char *buf );
 int rprintcap( struct printer *pr );

-void getprinters( char *cf );
+static void getprinters( char *cf );

 
 
 /* this only needs to be used by the server process */
 
 
 /* this only needs to be used by the server process */


@@ -539,19 +539,21 @@ int getstatus( pr, buf )
 char   *pgetstr();
 char   *getpname();
 
 char   *pgetstr();
 char   *getpname();
 

-void getprinters( cf )
+#define PF_CONFBUFFER  1024
+
+static void getprinters( cf )

     char       *cf;
 {
     char       *cf;
 {

-    char               buf[ 1024 ], area[ 1024 ], *a, *p, *name, *type, *zone;
+    char               buf[ PF_CONFBUFFER ], area[ PF_CONFBUFFER ], *a, *p, *name, *type, *zone;

     struct printer     *pr;
     int                        c;
 
     struct printer     *pr;
     int                        c;
 

-    while (( c = getprent( cf, buf )) > 0 ) {
+    while (( c = getprent( cf, buf, PF_CONFBUFFER )) > 0 ) {

        a = area;
        /*
         * Get the printer's nbp name.
         */
        a = area;
        /*
         * Get the printer's nbp name.
         */

-       if (( p = getpname( &a )) == NULL ) {
+       if (( p = getpname( &a, PF_CONFBUFFER )) == NULL ) {

            fprintf( stderr, "No printer name\n" );
            exit( 1 );
        }
            fprintf( stderr, "No printer name\n" );
            exit( 1 );
        }

diff --git a/etc/papd/printcap.c b/etc/papd/printcap.c
index aefe6df1087d9534b4872b773b1a922d08ac1ed8..6a1821d2375238c5f74c34cb39835088e3714638 100644 (file)
--- a/etc/papd/printcap.c
+++ b/etc/papd/printcap.c
@@ -1,5 +1,5 @@
 /*
 /*

- * $Id: printcap.c,v 1.5.2.1 2002-02-07 23:59:33 srittau Exp $
+ * $Id: printcap.c,v 1.5.2.2 2002-08-20 20:42:24 srittau Exp $

  *
  * Copyright (c) 1990,1994 Regents of The University of Michigan.
  * All Rights Reserved.  See COPYRIGHT.
  *
  * Copyright (c) 1990,1994 Regents of The University of Michigan.
  * All Rights Reserved.  See COPYRIGHT.


@@ -108,15 +108,17 @@ char      *getenv();
  * Added a "cap" parameter, so we can use these calls for printcap
  * and papd.conf.
  */
  * Added a "cap" parameter, so we can use these calls for printcap
  * and papd.conf.
  */

-int getprent( cap, bp)
+int getprent( cap, bp, bufsize )

        register char *cap;
        register char *bp;
        register char *cap;
        register char *bp;

+       register int bufsize;

 {
 {

-       register int c, skip = 0;
+       register int c, skip = 0, i;

 
        if (pfp == NULL && (pfp = fopen( cap, "r")) == NULL)
                return(-1);
        tbuf = bp;
 
        if (pfp == NULL && (pfp = fopen( cap, "r")) == NULL)
                return(-1);
        tbuf = bp;

+       i = 0;

        for (;;) {
                switch (c = getc(pfp)) {
                case EOF:
        for (;;) {
                switch (c = getc(pfp)) {
                case EOF:


@@ -146,6 +148,13 @@ int getprent( cap, bp)
                                return(1);
                        }
                        *bp++ = c;
                                return(1);
                        }
                        *bp++ = c;

+                       if (++i >= bufsize) {
+                               write(2, "config file too large\n", 22);
+                               fclose(pfp);
+                               pfp = NULL;
+                               *bp = '\0';
+                               return(1);
+                       }

                }
        }
 }
                }
        }
 }


@@ -485,9 +494,10 @@ nextc:
 }
 
 static char *
 }
 
 static char *

-decodename(str, area)
+decodename(str, area, bufsize)

        register char *str;
        char **area;
        register char *str;
        char **area;

+       int bufsize;

 {
        register char *cp;
        register int c;
 {
        register char *cp;
        register int c;


@@ -495,7 +505,7 @@ decodename(str, area)
        int i;
 
        cp = *area;
        int i;
 
        cp = *area;

-       while ((c = *str++) && c != ':' && c != '|' ) {
+       while ((c = *str++) && --bufsize && c != ':' && c != '|' ) {

                switch (c) {
 
                case '^':
                switch (c) {
 
                case '^':


@@ -530,8 +540,9 @@ nextc:
 }
 
 char *
 }
 
 char *

-getpname( area )
-    char       **area;
+getpname( area, bufsize )
+       char    **area;
+       int     bufsize;

 {
 {

-    return( decodename( tbuf, area ));
+       return( decodename( tbuf, area, bufsize));

 }
 }

diff --git a/etc/papd/printcap.h b/etc/papd/printcap.h
index 745d3315ce0e25dfb0fd45ec006995cab01cbf45..0a727db9adc44f1708d0f364646d9d6ef3b39c28 100644 (file)
--- a/etc/papd/printcap.h
+++ b/etc/papd/printcap.h
@@ -1,5 +1,5 @@
 /*
 /*

- * $Id: printcap.h,v 1.3 2001-06-25 20:13:45 rufustfirefly Exp $
+ * $Id: printcap.h,v 1.3.2.1 2002-08-20 20:42:24 srittau Exp $

  */
 
 #ifndef PAPD_PRINTCAP_H
  */
 
 #ifndef PAPD_PRINTCAP_H


@@ -7,7 +7,7 @@
 
 #include <sys/cdefs.h>
 
 
 #include <sys/cdefs.h>
 

-int getprent __P(( register char *, register char * ));
+int getprent __P(( register char *, register char *, register int ));

 int pnchktc __P(( char * ));
 int pgetflag __P(( char * ));
 void endprent __P(( void ));
 int pnchktc __P(( char * ));
 int pgetflag __P(( char * ));
 void endprent __P(( void ));