[Bug 3452] PARSE driver prints uninitialized memory

bk: 5a6b5363GKT6YHU98BuPdEvEmPLing

diff --git a/ChangeLog b/ChangeLog
index cabeba3ca7ce39bbf0332ec1f59ad0fdab4e805e..592f4d57c1ba01f5c64772171085acefcd256077 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,7 @@
   - initial patch by <stenn@ntp.org>, extended by <perlinger@ntp.org>
 * [Sec 3412] ctl_getitem(): Don't compare names past NUL. <perlinger@ntp.org>
 * [Sec 3012] Sybil vulnerability: noepeer support.  HStenn, JPerlinger.
+* [Bug 3452] PARSE driver prints uninitialized memory. <perlinger@ntp.org>
 * [Bug 3450] Dubious error messages from plausibility checks in get_systime()
  - removed error log caused by rounding/slew, ensured postcondition <perlinger@ntp.org>
 * [Bug 3447] AES-128-CMAC (fixes) <perlinger@ntp.org>

diff --git a/ntpd/refclock_parse.c b/ntpd/refclock_parse.c
index cf81e40e6d4c3edd51139362e115cb7e83d9ce5e..cfe2a8968886674126938e3f953a34278f27dabb 100644 (file)
--- a/ntpd/refclock_parse.c
+++ b/ntpd/refclock_parse.c
@@ -3614,7 +3614,9 @@ parse_control(
                }
                else
                {
-                       int count = tmpctl.parseformat.parse_count - 1;
+                       int count = tmpctl.parseformat.parse_count;
+                       if (count)
+                               --count;
 
                        start = tt = add_var(&out->kv_list, 80, RO|DEF);
                        tt = ap(start, 80, tt, "refclock_format=\"");
@@ -3780,9 +3782,14 @@ parse_process(
                        }
                        else
                        {
+                               unsigned int count = tmpctl.parsegettc.parse_count;
+                               if (count)
+                                       --count;
                                ERR(ERR_BADDATA)
-                                       msyslog(LOG_WARNING, "PARSE receiver #%d: FAILED TIMECODE: \"%s\" (check receiver configuration / wiring)",
-                                               CLK_UNIT(parse->peer), mkascii(buffer, sizeof buffer, tmpctl.parsegettc.parse_buffer, (unsigned)(tmpctl.parsegettc.parse_count - 1)));
+                                   msyslog(LOG_WARNING, "PARSE receiver #%d: FAILED TIMECODE: \"%s\" (check receiver configuration / wiring)",
+                                           CLK_UNIT(parse->peer),
+                                           mkascii(buffer, sizeof(buffer),
+                                                   tmpctl.parsegettc.parse_buffer, count));
                        }
                        /* copy status to show only changes in case of failures */
                        parse->timedata.parse_status = parsetime->parse_status;