pullups from 1.2

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/V1_0_BRANCH@12304 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/appl/bsd/ChangeLog b/src/appl/bsd/ChangeLog
index 5fb74c869d3d94ffa988ed952aa3079295dace84..a439598acb7c5d6e4d1a3a9b36870d500af1faa1 100644 (file)
--- a/src/appl/bsd/ChangeLog
+++ b/src/appl/bsd/ChangeLog
@@ -1,3 +1,7 @@
+2000-04-27  Nalin Dahyabhai  <nalin@redhat.com>
+
+       * krshd.c (doit): Don't overflow buffer "cmdbuf".
+
 Fri Mar 12 19:01:35 1999  Tom Yu  <tlyu@mit.edu>
 
        * Makefile.in (kshd): Add $(LOGINLIBS).

diff --git a/src/appl/bsd/krshd.c b/src/appl/bsd/krshd.c
index 8de25de396ad11f7eeb453f5cdaf340220b5b9fa..7c80fe53c573ac527bab983a7e81bb6cd68ef4e1 100644 (file)
--- a/src/appl/bsd/krshd.c
+++ b/src/appl/bsd/krshd.c
@@ -1469,15 +1469,16 @@ if(port)
         strcpy((char *) cmdbuf + offst, kprogdir);
        cp = copy + 3 + offst;
 
+       cmdbuf[sizeof(cmdbuf) - 1] = '\0';
        if (auth_sys == KRB5_RECVAUTH_V4) {
-         strcat(cmdbuf, "/v4rcp");
+         strncat(cmdbuf, "/v4rcp", sizeof(cmdbuf) - 1 - strlen(cmdbuf));
        } else {
-         strcat(cmdbuf, "/rcp");
+         strncat(cmdbuf, "/rcp", sizeof(cmdbuf) - 1 - strlen(cmdbuf));
        }
        if (stat((char *)cmdbuf + offst, &s) >= 0)
-         strcat(cmdbuf, cp);
+         strncat(cmdbuf, cp, sizeof(cmdbuf) - 1 - strlen(cmdbuf));
        else
-         strcpy(cmdbuf, copy);
+         strncpy(cmdbuf, copy, sizeof(cmdbuf) - 1 - strlen(cmdbuf));
        free(copy);
     }
 #endif

diff --git a/src/lib/krb4/ChangeLog b/src/lib/krb4/ChangeLog
index 183237a4ab4b57b40767b7ee046d5a8b0023d83d..64a0d41a0b39e67a79046b317c44f2c216211a06 100644 (file)
--- a/src/lib/krb4/ChangeLog
+++ b/src/lib/krb4/ChangeLog
@@ -1,3 +1,12 @@
+2000-04-28  Ken Raeburn  <raeburn@mit.edu>
+           Nalin Dahyabhai  <nalin@redhat.com>
+
+       * kuserok.c (kuserok): Don't overflow buffer "pbuf".
+
+2000-04-28  Tom Yu  <tlyu@mit.edu>
+
+       * rd_req.c (krb_rd_req): Fix some uses of strcpy().
+
 Thu Apr 15 20:18:38 1999  Tom Yu  <tlyu@mit.edu>
 
        * g_cnffile.c (krb__get_srvtabname): Fix to actually extract

diff --git a/src/lib/krb4/kuserok.c b/src/lib/krb4/kuserok.c
index 6f45afeb38d7bbc775abcd6c680bb7129dd22776..154e38c3a41ee06104b267d924f29fec58a2a8dc 100644 (file)
--- a/src/lib/krb4/kuserok.c
+++ b/src/lib/krb4/kuserok.c
@@ -115,8 +115,11 @@ kuserok(kdata, luser)
     if ((pwd = getpwnam(luser)) == NULL) {
        return(NOTOK);
     }
-    (void) strcpy(pbuf, pwd->pw_dir);
-    (void) strcat(pbuf, "/.klogin");
+    if (strlen (pwd->pw_dir) + sizeof ("/.klogin") >= sizeof (pbuf))
+       return NOTOK;
+    (void) strncpy(pbuf, pwd->pw_dir, sizeof(pbuf) - 1);
+    pbuf[sizeof(pbuf) - 1] = '\0';
+    (void) strncat(pbuf, "/.klogin", sizeof(pbuf) - 1 - strlen(pbuf));
 
     if (access(pbuf, F_OK)) {   /* not accessible */
        /*

diff --git a/src/lib/krb4/rd_req.c b/src/lib/krb4/rd_req.c
index fc9580ce65d6e81d404704af4d77e4caf7fa7d99..39648159322588df7bc5ac6ac0e1dc66c5c693de 100644 (file)
--- a/src/lib/krb4/rd_req.c
+++ b/src/lib/krb4/rd_req.c
@@ -155,6 +155,8 @@ krb_rd_req(authent,service,instance,from_addr,ad,fn)
                                   Kerberos used to encrypt ticket */
     int status;
 
+    tkt->mbz = req_id->mbz = 0;
+
     if (authent->length <= 0)
        return(RD_AP_MODIFIED);
 
@@ -190,8 +192,9 @@ krb_rd_req(authent,service,instance,from_addr,ad,fn)
         mutual = 0;
 #endif /* lint */
     s_kvno = *ptr++;           /* get server key version */
-    (void) strcpy(realm,ptr);   /* And the realm of the issuing KDC */
-    ptr += strlen(ptr) + 1;     /* skip the realm "hint" */
+    (void) strncpy(realm,ptr,REALM_SZ);        /* And the realm of the issuing KDC */
+    realm[REALM_SZ-1] = '\0';
+    ptr += strlen(realm) + 1;  /* skip the realm "hint" */
 
     /*
      * If "fn" is NULL, key info should already be set; don't
@@ -277,13 +280,16 @@ krb_rd_req(authent,service,instance,from_addr,ad,fn)
 #define check_ptr() if ((ptr - (char *) req_id->dat) > req_id->length) return(RD_AP_MODIFIED);
 
     ptr = (char *) req_id->dat;
-    (void) strcpy(r_aname,ptr);        /* Authentication name */
+    (void) strncpy(r_aname,ptr,ANAME_SZ); /* Authentication name */
+    r_aname[ANAME_SZ-1] = '\0';
     ptr += strlen(r_aname)+1;
     check_ptr();
-    (void) strcpy(r_inst,ptr); /* Authentication instance */
+    (void) strncpy(r_inst,ptr,INST_SZ);        /* Authentication instance */
+    r_inst[INST_SZ-1] = '\0';
     ptr += strlen(r_inst)+1;
     check_ptr();
-    (void) strcpy(r_realm,ptr);        /* Authentication name */
+    (void) strncpy(r_realm,ptr,REALM_SZ); /* Authentication name */
+    r_realm[REALM_SZ-1] = '\0';
     ptr += strlen(r_realm)+1;
     check_ptr();
     memcpy((char *)&ad->checksum, ptr, 4);     /* Checksum */

diff --git a/src/lib/krb5/krb/ChangeLog b/src/lib/krb5/krb/ChangeLog
index a1a5bacc41309b8c744524266db955bbd54d8fa9..5fb640f464b50b5967ec0019065ac384dbde96e9 100644 (file)
--- a/src/lib/krb5/krb/ChangeLog
+++ b/src/lib/krb5/krb/ChangeLog
@@ -1,3 +1,8 @@
+2000-04-28  Nalin Dahyabhai  <nalin@redhat.com>
+
+       * conv_princ.c (krb5_425_conv_principal): Don't overflow buffer
+       "buf".
+
 2000-02-01  Ken Raeburn  <raeburn@mit.edu>
 
        * init_ctx.c (init_common): Renamed from krb5_init_context, now

diff --git a/src/lib/krb5/krb/conv_princ.c b/src/lib/krb5/krb/conv_princ.c
index e1833b3f592ea532f377e281ad416736fc22d68f..df19498568f845669ea6801539cbe8b2e929b804 100644 (file)
--- a/src/lib/krb5/krb/conv_princ.c
+++ b/src/lib/krb5/krb/conv_princ.c
@@ -243,7 +243,8 @@ krb5_425_conv_principal(context, name, instance, realm, princ)
              if (retval == 0 && full_name && full_name[0]) {
                  instance = full_name[0];
              } else {
-                 strcpy(buf, instance);
+                 strncpy(buf, instance, sizeof(buf));
+                 buf[sizeof(buf) - 1] = '\0';
                  retval = krb5_get_realm_domain(context, realm, &domain);
                  if (retval)
                      return retval;
@@ -251,8 +252,8 @@ krb5_425_conv_principal(context, name, instance, realm, princ)
                      for (cp = domain; *cp; cp++)
                          if (isupper(*cp))
                              *cp = tolower(*cp);
-                     strcat(buf, ".");
-                     strcat(buf, domain);
+                     strncat(buf, ".", sizeof(buf) - 1 - strlen(buf));
+                     strncat(buf, domain, sizeof(buf) - 1 - strlen(buf));
                      krb5_xfree(domain);
                  }
                  instance = buf;

diff --git a/src/lib/krb5/os/ChangeLog b/src/lib/krb5/os/ChangeLog
index 2c1842f30919de3a96904554a52b0314ebbf86e8..4d6914b479a392406930346a3e64a0065d363b45 100644 (file)
--- a/src/lib/krb5/os/ChangeLog
+++ b/src/lib/krb5/os/ChangeLog
@@ -1,3 +1,7 @@
+2000-04-28  Nalin Dahyabhai  <nalin@redhat.com>
+
+       * kuserok.c (krb5_kuserok): Don't overflow buffer "pbuf".
+
 Thu Mar 25 18:45:48 1999  Tom Yu  <tlyu@mit.edu>
 
        * promptusr.c (krb5_os_get_tty_uio): getchar() returns int, not

diff --git a/src/lib/krb5/os/kuserok.c b/src/lib/krb5/os/kuserok.c
index 3e54fa0c1e28ef12a0f5b8b7845b1cb549f39c86..f81715112336aa92f351ce90510881184b11d425 100644 (file)
--- a/src/lib/krb5/os/kuserok.c
+++ b/src/lib/krb5/os/kuserok.c
@@ -77,8 +77,9 @@ krb5_kuserok(context, principal, luser)
     if ((pwd = getpwnam(luser)) == NULL) {
        return(FALSE);
     }
-    (void) strcpy(pbuf, pwd->pw_dir);
-    (void) strcat(pbuf, "/.k5login");
+    (void) strncpy(pbuf, pwd->pw_dir, sizeof(pbuf) - 1);
+    pbuf[sizeof(pbuf) - 1] = '\0';
+    (void) strncat(pbuf, "/.k5login", sizeof(pbuf) - 1 - strlen(pbuf));
 
     if (access(pbuf, F_OK)) {   /* not accessible */
        /*

diff --git a/src/lib/krb5/posix/ChangeLog b/src/lib/krb5/posix/ChangeLog
index e94ad00dc3fd701af771bc0e3cfc0008247eb4e1..8f0c2fb6220506f06628b04872d14a255d55695c 100644 (file)
--- a/src/lib/krb5/posix/ChangeLog
+++ b/src/lib/krb5/posix/ChangeLog
@@ -1,3 +1,10 @@
+2000-04-28  Ken Raeburn  <raeburn@mit.edu>
+           Nalin Dahyabhai  <nalin@redhat.com>
+
+       * syslog.c (vsyslog): Use strncpy and strncat instead of strcpy
+       and strcat when adding to buffer "tbuf".  If calling vsprintf,
+       abort if it appears to have overrun the buffer.
+
 Mon Jun 10 21:51:35 1996  Theodore Ts'o  <tytso@rsts-11.mit.edu>
 
        * syslog.c: Change _WINDOWS to _MSDOS, and add check for _WIN32.

diff --git a/src/lib/krb5/posix/syslog.c b/src/lib/krb5/posix/syslog.c
index b853f046d024021ca4bfc47ba384162c0824d764..e581b3c405f84b7f5121bfeb1937b49a21c31587 100644 (file)
--- a/src/lib/krb5/posix/syslog.c
+++ b/src/lib/krb5/posix/syslog.c
@@ -115,7 +115,7 @@ vsyslog(pri, fmt, ap)
        (void)sprintf(tbuf, "<%d>%.15s ", pri, ctime(&now) + 4);
        for (p = tbuf; *p; ++p);
        if (LogTag) {
-               (void)strcpy(p, LogTag);
+               (void)strncpy(p, LogTag, sizeof(tbuf) - 1 - (p - tbuf));
                for (; *p; ++p);
        }
        if (LogStat & LOG_PID) {
@@ -146,6 +146,11 @@ vsyslog(pri, fmt, ap)
        }
 
        (void)vsprintf(p, fmt_cpy, ap);
+       /* Bounds checking??  If a system doesn't have syslog, we
+          probably can't rely on it having vsnprintf either.  Try not
+          to let a buffer overrun be exploited.  */
+       if (strlen (tbuf) >= sizeof (tbuf))
+         abort ();
 
        /* output the message to the local logger */
        if (send(LogFile, tbuf, cnt = strlen(tbuf), 0) >= 0 ||
@@ -169,7 +174,8 @@ vsyslog(pri, fmt, ap)
                if ((fd = open(CONSOLE, O_WRONLY, 0)) < 0)
                        return;
                (void)alarm((u_int)0);
-               (void)strcat(tbuf, "\r");
+               tbuf[sizeof(tbuf) - 1] = '\0';
+               (void)strncat(tbuf, "\r", sizeof(tbuf) - 1 - strlen(tbuf));
                p = strchr(tbuf, '>') + 1;
                (void)write(fd, p, cnt + 1 - (p - tbuf));
                (void)close(fd);