[Bug 2145] ntpq dumps core when displaying sys_var_list and more

bk: 51807facD5KWsrGTr4_9gGjqCNVsNg

diff --git a/ChangeLog b/ChangeLog
index 3004238aff8fe7cbe792d4f3937ab25667752194..8b28caad365d9d675ec0fc7066a8812da8e070a1 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,4 @@
+* [Bug 2145] ntpq dumps core when displaying sys_var_list and more.
 (4.2.7p367) 2013/04/25 Released by Harlan Stenn <stenn@ntp.org>
 * [Bug 1485] Sometimes ntpd crashes
 * [Bug 2382] Implement LOGTOD using ldexp() instead of shifting.

diff --git a/ntpd/ntp_control.c b/ntpd/ntp_control.c
index 2fe55c0523f62e4b5f6a78c3d95a526fc69e129e..28073133f5354566cdfebf784ca0413bd3e87d77 100644 (file)
--- a/ntpd/ntp_control.c
+++ b/ntpd/ntp_control.c
@@ -1843,26 +1843,39 @@ ctl_putsys(
                break;
 
        case CS_VARLIST:
-               snprintf(str, sizeof(str), "%s=\"",
-                        sys_var[CS_VARLIST].text);
-               ctl_putdata(str, strlen(str), TRUE);
+       {
+               char buf[CTL_MAX_DATA_LEN];
+               //buffPointer, firstElementPointer, buffEndPointer
+               register char *buffp, *buffend;
+               register int firstVarName;
+               register const char *ss;
+               register int len;
+               register struct ctl_var *k;
+
+               buffp = buf;
+               buffend = buf + sizeof(buf);
+               if (buffp + strlen(sys_var[CS_VARLIST].text) + 4 > buffend)
+                       break;  /* really long var name */
 
-               firstvarname = TRUE;
-               for (k = sys_var; !(EOV & k->flags); k++) {
-                       if (PADDING & k->flags)
+               snprintf(buffp, sizeof(buf), "%s=\"",sys_var[CS_VARLIST].text);
+               buffp += strlen(buffp);
+               firstVarName = TRUE;
+               for (k = sys_var; !(k->flags & EOV); k++) {
+                       if (k->flags & PADDING)
                                continue;
                        len = strlen(k->text);
-                       if (0 == len)
-                               continue;
-                       if (!firstvarname)
-                               ctl_putdata(",", 1, TRUE);
+                       if (buffp + len + 1 >= buffend)
+                               break;
+                       if (!firstVarName)
+                               *buffp++ = ',';
                        else
-                               firstvarname = FALSE;
-                       ctl_putdata(k->text, len, TRUE);
+                               firstVarName = FALSE;
+                       memcpy(buffp, k->text, len);
+                       buffp += len;
                }
 
-               for (k = ext_sys_var; k && !(EOV & k->flags); k++) {
-                       if (PADDING & k->flags)
+               for (k = ext_sys_var; k && !(k->flags & EOV); k++) {
+                       if (k->flags & PADDING)
                                continue;
                        if (NULL == k->text)
                                continue;
@@ -1871,13 +1884,25 @@ ctl_putsys(
                                len = strlen(k->text);
                        else
                                len = ss - k->text;
-                       ctl_putdata(",", 1, TRUE);
-                       ctl_putdata(k->text, len, TRUE);
+                       if (buffp + len + 1 >= buffend)
+                               break;
+                       if (firstVarName) {
+                               *buffp++ = ',';
+                               firstVarName = FALSE;
+                       }
+                       memcpy(buffp, k->text,(unsigned)len);
+                       buffp += len;
                }
+               if (buffp + 2 >= buffend)
+                       break;
 
-               ctl_putdata("\"", 1, TRUE);
-               break;
+               *buffp++ = '"';
+               *buffp = '\0';
 
+               ctl_putdata(buf, (unsigned)( buffp - buf ), 0);
+               break;
+       }
+    
        case CS_TAI:
                if (sys_tai > 0)
                        ctl_putuint(sys_var[CS_TAI].text, sys_tai);