ntp_io.c:

  add missing BLOCKIO()/UNBLOCKIO() calls in refclock io
  handling found during analysis for bug #619
refclock_parse.c:
  bug #619
  complete refclock io structure initialization *before* inserting it into the
  refclock input machine (avoids null pointer deref)

bk: 4475f2b1tXzkVwRb-pK9iYj2apmtwQ

diff --git a/ntpd/ntp_io.c b/ntpd/ntp_io.c
index 5a99737fe8cbb942c4503e8df16a1bdddb0753d3..e630355269c82e49c3938891c34671f225a62b76 100644 (file)
--- a/ntpd/ntp_io.c
+++ b/ntpd/ntp_io.c
@@ -2744,6 +2744,7 @@ io_closeclock(
        struct refclockio *rio
        )
 {
+       BLOCKIO();
        /*
         * Remove structure from the list
         */
@@ -2770,6 +2771,7 @@ io_closeclock(
         * Close the descriptor.
         */
        close_file(rio->fd);
+       UNBLOCKIO();
 }
 #endif /* REFCLOCK */
 
@@ -2787,6 +2789,7 @@ kill_asyncio(
        BLOCKIO();
        for (i = startfd; i <= maxactivefd; i++)
            (void)close_socket(i);
+       UNBLOCKIO();
 }
 #else
 /*
@@ -2808,6 +2811,7 @@ kill_asyncio(int startfd)
                close_socket(lsock->fd);
                lsock = next;
        }
+       UNBLOCKIO();
 
 }
 #endif

diff --git a/ntpd/refclock_parse.c b/ntpd/refclock_parse.c
index 29b5893de852dd68501dc214275dd9fd79486405..cfa263f0c4a4843f5c8f16fec9624e40a6d0c713 100644 (file)
--- a/ntpd/refclock_parse.c
+++ b/ntpd/refclock_parse.c
@@ -1,7 +1,7 @@
 /*
- * /src/NTP/REPOSITORY/ntp4-dev/ntpd/refclock_parse.c,v 4.68 2006/05/01 17:02:51 kardel RELEASE_20060501_A
+ * /src/NTP/REPOSITORY/ntp4-dev/ntpd/refclock_parse.c,v 4.69 2006/05/25 17:28:02 kardel RELEASE_20060525_B
  *
- * refclock_parse.c,v 4.68 2006/05/01 17:02:51 kardel RELEASE_20060501_A
+ * refclock_parse.c,v 4.69 2006/05/25 17:28:02 kardel RELEASE_20060525_B
  *
  * generic reference clock driver for several DCF/GPS/MSF/... receivers
  *
@@ -182,7 +182,7 @@
 #include "ieee754io.h"
 #include "recvbuff.h"
 
-static char rcsid[] = "refclock_parse.c,v 4.68 2006/05/01 17:02:51 kardel RELEASE_20060501_A";
+static char rcsid[] = "refclock_parse.c,v 4.69 2006/05/25 17:28:02 kardel RELEASE_20060525_B";
 
 /**===========================================================================
  ** external interface to ntp mechanism
@@ -2994,19 +2994,11 @@ parse_start(
        }
 
        /*
-        * Insert in async io device list.
+        * pick correct input machine
         */
        parse->generic->io.srcclock = (caddr_t)parse;
        parse->generic->io.datalen = 0;
        
-       if (!io_addclock(&parse->generic->io))
-        {
-               msyslog(LOG_ERR,
-                       "PARSE receiver #%d: parse_start: addclock %s fails (ABORT - clock type requires async io)", CLK_UNIT(parse->peer), parsedev);
-               parse_shutdown(CLK_UNIT(parse->peer), peer); /* let our cleaning staff do the work */
-               return 0;
-       }
-
        parse->binding = init_iobinding(parse);
 
        if (parse->binding == (bind_t *)0)
@@ -3019,6 +3011,17 @@ parse_start(
        parse->generic->io.clock_recv = parse->binding->bd_receive; /* pick correct receive routine */
        parse->generic->io.io_input   = parse->binding->bd_io_input; /* pick correct input routine */
 
+       /*
+        * Insert in async io device list.
+        */
+       if (!io_addclock(&parse->generic->io))
+        {
+               msyslog(LOG_ERR,
+                       "PARSE receiver #%d: parse_start: addclock %s fails (ABORT - clock type requires async io)", CLK_UNIT(parse->peer), parsedev);
+               parse_shutdown(CLK_UNIT(parse->peer), peer); /* let our cleaning staff do the work */
+               return 0;
+       }
+
        /*
         * as we always(?) get 8 bit chars we want to be
         * sure, that the upper bits are zero for less
@@ -5678,6 +5681,10 @@ int refclock_parse_bs;
  * History:
  *
  * refclock_parse.c,v
+ * Revision 4.69  2006/05/25 17:28:02  kardel
+ * complete refclock io structure initialization *before* inserting it into the
+ * refclock input machine (avoids null pointer deref) (bug #619)
+ *
  * Revision 4.68  2006/05/01 17:02:51  kardel
  * copy receiver method also for newlwy created receive buffers
  *