Trunk-BP: validity checking.

diff --git a/etc/afpd/enumerate.c b/etc/afpd/enumerate.c
index dcbf5bcc3d8fec4834985d9963c92d72d51937a1..90de28f5cc8fe8449f62c37d5d0aa355034543f9 100644 (file)
--- a/etc/afpd/enumerate.c
+++ b/etc/afpd/enumerate.c
@@ -1,5 +1,5 @@
 /*
- * $Id: enumerate.c,v 1.9.2.2 2002-01-02 17:27:50 srittau Exp $
+ * $Id: enumerate.c,v 1.9.2.3 2002-02-07 23:56:04 srittau Exp $
  *
  * Copyright (c) 1990,1993 Regents of The University of Michigan.
  * All Rights Reserved.  See COPYRIGHT.
@@ -39,6 +39,8 @@
 #include "parse_mtab.h"
 #endif /* DID_MTAB */
 
+#define min(a,b)       ((a)<(b)?(a):(b))
+
 struct dir *
             adddir( vol, dir, name, namlen, upath, upathlen, st )
             struct vol *vol;
@@ -205,6 +207,8 @@ int         ibuflen, *rbuflen;
     maxsz = ntohs( maxsz );
     ibuf += sizeof( maxsz );
 
+    maxsz = min(maxsz, *rbuflen);
+
     if (( path = cname( vol, dir, &ibuf )) == NULL ) {
         *rbuflen = 0;
         return( AFPERR_NODIR );

diff --git a/etc/uams/uams_passwd.c b/etc/uams/uams_passwd.c
index 365707ef9881afc87b79f76068fe3989e4d13fee..97d93a256df76cd2505a21eb70ca951b239d7f43 100644 (file)
--- a/etc/uams/uams_passwd.c
+++ b/etc/uams/uams_passwd.c
@@ -1,5 +1,5 @@
 /*
- * $Id: uams_passwd.c,v 1.13 2001-09-06 20:00:59 rufustfirefly Exp $
+ * $Id: uams_passwd.c,v 1.13.2.1 2002-02-08 00:00:01 srittau Exp $
  *
  * Copyright (c) 1990,1993 Regents of The University of Michigan.
  * Copyright (c) 1999 Adrian Sun (asun@u.washington.edu) 
@@ -59,8 +59,8 @@ static char *clientname;
 
 /* cleartxt login */
 static int passwd_login(void *obj, struct passwd **uam_pwd,
-                       char *ibuf, int ibuflen,
-                       char *rbuf, int *rbuflen)
+                        char *ibuf, int ibuflen,
+                        char *rbuf, int *rbuflen)
 {
     struct passwd *pwd;
 #ifdef SHADOWPW
@@ -72,8 +72,8 @@ static int passwd_login(void *obj, struct passwd **uam_pwd,
     *rbuflen = 0;
 
     if (uam_afpserver_option(obj, UAM_OPTION_USERNAME,
-                            (void *) &username, &ulen) < 0)
-      return AFPERR_MISC;
+                             (void *) &username, &ulen) < 0)
+        return AFPERR_MISC;
 
 #ifdef TRU64
     if( uam_afpserver_option( obj, UAM_OPTION_CLIENTNAME,
@@ -81,25 +81,38 @@ static int passwd_login(void *obj, struct passwd **uam_pwd,
         return AFPERR_MISC;
 #endif /* TRU64 */
 
+    if (ibuflen <= 1) {
+        return( AFPERR_PARAM );
+    }
+
     len = (unsigned char) *ibuf++;
-    if ( len > ulen ) {
-       return( AFPERR_PARAM );
+    ibuflen--;
+    if (!len || len > ibuflen || len > ulen ) {
+        return( AFPERR_PARAM );
     }
 
     memcpy(username, ibuf, len );
     ibuf += len;
+    ibuflen -=len;
     username[ len ] = '\0';
-    if ((unsigned long) ibuf & 1) /* pad character */
-      ++ibuf;
+
+    if ((unsigned long) ibuf & 1) { /* pad character */
+        ++ibuf;
+        ibuflen--;
+    }
+    if (ibuflen < PASSWDLEN) {
+        return( AFPERR_PARAM );
+    }
     ibuf[ PASSWDLEN ] = '\0';
 
     if (( pwd = uam_getname(username, ulen)) == NULL ) {
-       return AFPERR_PARAM;
+        return AFPERR_PARAM;
     }
 
     syslog(LOG_INFO, "cleartext login: %s", username);
-    if (uam_checkuser(pwd) < 0)
-      return AFPERR_NOTAUTH;
+    if (uam_checkuser(pwd) < 0) {
+        return AFPERR_NOTAUTH;
+    }
 
 #ifdef SHADOWPW
     if (( sp = getspnam( pwd->pw_name )) == NULL ) {
@@ -109,8 +122,9 @@ static int passwd_login(void *obj, struct passwd **uam_pwd,
     pwd->pw_passwd = sp->sp_pwdp;
 #endif /* SHADOWPW */
 
-    if (!pwd->pw_passwd)
-      return AFPERR_NOTAUTH;
+    if (!pwd->pw_passwd) {
+        return AFPERR_NOTAUTH;
+    }
 
     *uam_pwd = pwd;
 
@@ -131,8 +145,8 @@ static int passwd_login(void *obj, struct passwd **uam_pwd,
     }
 #else /* TRU64 */
     p = crypt( ibuf, pwd->pw_passwd );
-    if ( strcmp( p, pwd->pw_passwd ) == 0 ) 
-      return AFP_OK;
+    if ( strcmp( p, pwd->pw_passwd ) == 0 )
+        return AFP_OK;
 #endif /* TRU64 */
 
     return AFPERR_NOTAUTH;
@@ -142,8 +156,8 @@ static int passwd_login(void *obj, struct passwd **uam_pwd,
 #if 0
 /* change passwd */
 static int passwd_changepw(void *obj, char *username,
-                          struct passwd *pwd, char *ibuf,
-                          int ibuflen, char *rbuf, int *rbuflen)
+                           struct passwd *pwd, char *ibuf,
+                           int ibuflen, char *rbuf, int *rbuflen)
 {
 #ifdef SHADOWPW
     struct spwd *sp;
@@ -152,7 +166,7 @@ static int passwd_changepw(void *obj, char *username,
     uid_t uid = geteuid();
 
     if (uam_checkuser(pwd) < 0)
-      return AFPERR_ACCESS;
+        return AFPERR_ACCESS;
 
     /* old password */
     memcpy(pw, ibuf, PASSWDLEN);
@@ -169,19 +183,19 @@ static int passwd_changepw(void *obj, char *username,
 
     p = crypt(pw, pwd->pw_passwd );
     if (strcmp( p, pwd->pw_passwd )) {
-      memset(pw, 0, sizeof(pw));
-      return AFPERR_NOTAUTH;
+        memset(pw, 0, sizeof(pw));
+        return AFPERR_NOTAUTH;
     }
 
     /* new password */
     ibuf += PASSWDLEN;
     ibuf[PASSWDLEN] = '\0';
-    
+
 #ifdef SHADOWPW
 #else /* SHADOWPW */
 #endif /* SHADOWPW */
     return AFP_OK;
-} 
+}
 #endif /* 0 */
 
 
@@ -243,8 +257,8 @@ static int passwd_printer(start, stop, username, out)
     }
 
     if (uam_checkuser(pwd) < 0) {
-       /* syslog of error happens in uam_checkuser */
-       return(-1);
+        /* syslog of error happens in uam_checkuser */
+        return(-1);
     }
 
 #ifdef SHADOWPW
@@ -263,8 +277,8 @@ static int passwd_printer(start, stop, username, out)
     }
 
 #ifdef AFS
-    if ( kcheckuser( pwd, password) == 0) 
-      return(0);
+    if ( kcheckuser( pwd, password) == 0)
+        return(0);
 #endif /* AFS */
 
     p = crypt(password, pwd->pw_passwd);
@@ -282,24 +296,24 @@ static int passwd_printer(start, stop, username, out)
 
 static int uam_setup(const char *path)
 {
-  if (uam_register(UAM_SERVER_LOGIN, path, "Cleartxt Passwrd", 
-               passwd_login, NULL, NULL) < 0)
-       return -1;
-  if (uam_register(UAM_SERVER_PRINTAUTH, path, "ClearTxtUAM",
-               passwd_printer) < 0)
-       return -1;
-
-  return 0;
+    if (uam_register(UAM_SERVER_LOGIN, path, "Cleartxt Passwrd",
+                     passwd_login, NULL, NULL) < 0)
+        return -1;
+    if (uam_register(UAM_SERVER_PRINTAUTH, path, "ClearTxtUAM",
+                     passwd_printer) < 0)
+        return -1;
+
+    return 0;
 }
 
 static void uam_cleanup(void)
 {
-  uam_unregister(UAM_SERVER_LOGIN, "Cleartxt Passwrd");
-  uam_unregister(UAM_SERVER_PRINTAUTH, "ClearTxtUAM");
+    uam_unregister(UAM_SERVER_LOGIN, "Cleartxt Passwrd");
+    uam_unregister(UAM_SERVER_PRINTAUTH, "ClearTxtUAM");
 }
 
 UAM_MODULE_EXPORT struct uam_export uams_clrtxt = {
-  UAM_MODULE_SERVER,
-  UAM_MODULE_VERSION,
-  uam_setup, uam_cleanup
-};
+            UAM_MODULE_SERVER,
+            UAM_MODULE_VERSION,
+            uam_setup, uam_cleanup
+        };