From: Harlan Stenn <stenn@ntp.org>
Date: Sat, 25 Sep 2010 21:14:57 +0000 (+0000)
Subject: [Bug 1643]: Range-check the decoding of the RIPE-NCC status codes
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d38aeeb22bbc90a7949ce9010d5ba494b0f2e272;p=thirdparty%2Fntp.git

[Bug 1643]: Range-check the decoding of the RIPE-NCC status codes

bk: 4c9e6651GDXN6_liakq50ewqFmUznQ
---

diff --git a/ChangeLog b/ChangeLog
index 24f2c9b102..e405a336c4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+---
+* [Bug 1643]: Range-check the decoding of the RIPE-NCC status codes.
+
 ---
 (4.2.6p3-RC2) 2010/09/25 Released by Harlan Stenn <stenn@ntp.org>
 
diff --git a/ntpd/refclock_ripencc.c b/ntpd/refclock_ripencc.c
index 994cd0c7bd..94a1de46d0 100644
--- a/ntpd/refclock_ripencc.c
+++ b/ntpd/refclock_ripencc.c
@@ -429,8 +429,8 @@ static	int	print_msg_table_header	(int rptcode, char *HdrStr, int force);
 static	char *	show_time	(float time_of_week);
 
 /* RIPE NCC functions */
-static	void	ripencc_control	(int, struct refclockstat *, struct
-				refclockstat *, struct peer *);
+static	void	ripencc_control	(int, const struct refclockstat *,
+				 struct refclockstat *, struct peer *);
 static	int	ripencc_ppsapi	(struct peer *, int, int);
 static	int	ripencc_get_pps_ts	(struct ripencc_unit *, l_fp *);
 static	int	ripencc_start	(int, struct peer *);
@@ -615,7 +615,7 @@ ripencc_start(int unit, struct peer *peer)
 static void
 ripencc_control(
 	int unit,		/* unit (not used) */
-	struct refclockstat *in, /* input parameters (not used) */
+	const struct refclockstat *in, /* input parameters (not used) */
 	struct refclockstat *out, /* output parameters (not used) */
 	struct peer *peer	/* peer structure pointer */
 	)
@@ -3179,7 +3179,9 @@ static void rpt_rcvr_health (TSIPPKT *rpt)
 {
 	unsigned char
 		status1, status2;
-	static char
+	const char
+		*text;
+	static const char const
 		*sc_text[] = {
 			"Doing position fixes",
 			"Don't have GPS time yet",
@@ -3203,8 +3205,11 @@ static void rpt_rcvr_health (TSIPPKT *rpt)
 		return;
 	}
 
+	text = (status1 < COUNTOF(sc_text))
+		   ? sc_text[status1]
+		   : "(out of range)";
 	pbuf += sprintf(pbuf, "\nRcvr status1: %s (%02Xh); ",
-     	sc_text[rpt->buf[0]], status1);
+     		text, status1);
 
 	pbuf += sprintf(pbuf, "status2: %s, %s (%02Xh)",
 		(status2 & 0x01)?"No BBRAM":"BBRAM OK",
@@ -3382,7 +3387,7 @@ static void rpt_operating_parameters (TSIPPKT *rpt)
 	pbuf += sprintf(pbuf, "\nOperating Parameters:");
 	pbuf += sprintf(pbuf, "\n     Dynamics code = %d %s",
    	dyn_code, dyn_text[dyn_code]);
-	pbuf += sprintf(pbuf, "\n     Elevation mask = %.2fø", el_mask * R2D);
+	pbuf += sprintf(pbuf, "\n     Elevation mask = %.2f?", el_mask * R2D);
 	pbuf += sprintf(pbuf, "\n     SNR mask = %.2f", snr_mask);
 	pbuf += sprintf(pbuf, "\n     DOP mask = %.2f", dop_mask);
 	pbuf += sprintf(pbuf, "\n     DOP switch = %.2f", dop_switch);