mtr v0.47

 - Fixed a (believed-) non-exploitable bufferoverflow.  Thanks Damian.

source: ftp://ftp.bitwizard.nl/mtr/mtr-0.47.tar.gz

diff --git a/AUTHORS b/AUTHORS
index 981965edecb4d57a62829e3ebd69b342586adc18..2a64c98b50fa1c62cd61a26efdaff12f7a31f1f2 100644 (file)
--- a/AUTHORS
+++ b/AUTHORS
@@ -10,34 +10,37 @@
   Thanks to everyone who has provided feedback on mtr.  
 
   Thanks especially to those of you who have sent code:
-  (Reverse alphabetical order)
-
-        Juha Takala, 
-        David Sward (sward@clark.net),
-        Andrew Stesin, 
-        Aaron Scarisbrick, 
-        Craig Milo Rogers (Rogers@ISI.EDU),
-        Russell Nelson (rn-mtr@crynwr.com),
-        Davin Milun (milun@acm.org),
-        Alexander V. Lukyanov (lav@yars.free.net), 
-        Charles Levert (charles@comm.polymtl.ca), 
-        Bertrand Leconte (B.Leconte@mail.dotcom.fr), 
-        Anand Kumria, 
-        Olav Kvittem (Olav.Kvittem@uninett.no),
-        Adam Kramer (l3zqc@qcunix1.acc.qc.edu), 
-        Philip Kizer (pckizer@nostrum.com), 
-        Simon Kirby, 
-        Christophe Kalt,
-        Steve Kann (stevek@spheara.horizonlive.com), 
-        Mircea Damian, 
-        Brian Casey, 
-        Bill Bogstad (bogstad@pobox.com), 
-        Moritz Barsnick (barsnick@gmx.net)
-        Robert Sparks (rjsparks@nostrum.com)
+  (Reverse alphabetical order, and sometimes I just add people at
+   the end... )
+
+        Bohdan Vlasyuk (bohdan@cec.vstu.vinnica.ua)
+        Juha Takala
+        David Sward (sward@clark.net)
         David Stone (stone@AsIf.com)
+        Andrew Stesin
         Greg Stark (gsstark@mit.edu)
+        Robert Sparks (rjsparks@nostrum.com)
+        Aaron Scarisbrick,
+        Craig Milo Rogers (Rogers@ISI.EDU)
+        Russell Nelson (rn-mtr@crynwr.com)
+        Davin Milun (milun@acm.org)
+        Alexander V. Lukyanov (lav@yars.free.net)
+        Charles Levert (charles@comm.polymtl.ca) 
+        Bertrand Leconte (B.Leconte@mail.dotcom.fr)
+        Anand Kumria
+        Olav Kvittem (Olav.Kvittem@uninett.no)
+        Adam Kramer (l3zqc@qcunix1.acc.qc.edu) 
+        Philip Kizer (pckizer@nostrum.com)
+        Simon Kirby
+        Christophe Kalt
+        Steve Kann (stevek@spheara.horizonlive.com)
+        Damian Gryski (dgryski@uwaterloo.ca)
+        Mircea Damian
+        Brian Casey
         Andrew Brown (atatat@atatdot.net)
+        Bill Bogstad (bogstad@pobox.com) 
         Marc Bejarano (marc.bejarano@openwave.com)
+        Moritz Barsnick (barsnick@gmx.net)
 
         and anyone who has slipped through the cracks of my mail file.
 

diff --git a/NEWS b/NEWS
index 43b825ff20bf8eab5faf2a55926a2d10d3f906f9..804797a734236ba2e54aee35a105a375756d5b11 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,9 @@
 WHAT'S NEW?
 
-  v0.45 Included patch to be able to specify outgoing interface 
+  v0.47 Fixed a (believed-) non-exploitable bufferoverflow. 
+        Thanks Damian. 
+
+  v0.46 Included patch to be able to specify outgoing interface 
         address.
 
   v0.45 People are pressuring me to release new versions with their

diff --git a/configure.in b/configure.in
index 06bfb447b21b0cbdb79afc5b8ab5c541a4333725..f8706a528d020f1bdce5644fb1b94fea96795b69 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -1,5 +1,5 @@
 AC_INIT(mtr.c)
-AM_INIT_AUTOMAKE(mtr, 0.46)
+AM_INIT_AUTOMAKE(mtr, 0.47)
 
 AC_SUBST(GTK_OBJ)
 AC_SUBST(CURSES_OBJ)

diff --git a/mtr.c b/mtr.c
index 5f53549b583503c4231291b4ae35d7b7d011c777..dd813327890cb399ff63eccbafd2badbefc286dd 100644 (file)
--- a/mtr.c
+++ b/mtr.c
@@ -144,16 +144,19 @@ void parse_mtr_options (char *string)
   argv[0] = "mtr";
   argc = 1;
   p = strtok (string, " \t");
-  while (p) {
+  while (p && (argc < (sizeof(argv)/sizeof(argv[0])))) {
     argv[argc++] = p;
     p = strtok (NULL, " \t");
   }
+  if (p) {
+    fprintf (stderr, "Warning: extra arguments ignored: %s", p);
+  }
+
   parse_arg (argc, argv);
   optind = 0;
 }
 
 
-
 int main(int argc, char **argv) {
   int traddr;
   struct hostent *host;