svn commit: r350139 - stable/12/contrib/telnet/telnet

[Philip Paeps]

Author: philip
Date: Fri Jul 19 15:37:29 2019
New Revision: 350139
URL: https://svnweb.freebsd.org/changeset/base/350139

Log:
  MFC r349890:
    telnet: fix a couple of snprintf() buffer overflows
  
    Obtained from:       Juniper Networks
  
  MFC r349896:
    telnet: fix minor style violationo
  
    While here also fix a very unlikely NULL pointer dereference.
  
    Submitted by:        Shawn Webb <shawn.webb at hardenedbsd.org>

Modified:
  stable/12/contrib/telnet/telnet/commands.c
  stable/12/contrib/telnet/telnet/telnet.c
  stable/12/contrib/telnet/telnet/utilities.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/contrib/telnet/telnet/commands.c
==============================================================================
--- stable/12/contrib/telnet/telnet/commands.c	Fri Jul 19 15:24:08 2019	(r350138)
+++ stable/12/contrib/telnet/telnet/commands.c	Fri Jul 19 15:37:29 2019	(r350139)
@@ -45,6 +45,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/socket.h>
 #include <netinet/in.h>
 
+#include <assert.h>
 #include <ctype.h>
 #include <err.h>
 #include <errno.h>
@@ -1654,11 +1655,14 @@ env_init(void)
 		|| (strncmp((char *)ep->value, "unix:", 5) == 0))) {
 		char hbuf[256+1];
 		char *cp2 = strchr((char *)ep->value, ':');
+                size_t buflen;
 
-		gethostname(hbuf, 256);
-		hbuf[256] = '\0';
-		cp = (char *)malloc(strlen(hbuf) + strlen(cp2) + 1);
-		sprintf((char *)cp, "%s%s", hbuf, cp2);
+		gethostname(hbuf, sizeof(hbuf));
+		hbuf[sizeof(hbuf)-1] = '\0';
+ 		buflen = strlen(hbuf) + strlen(cp2) + 1;
+		cp = (char *)malloc(sizeof(char)*buflen);
+		assert(cp != NULL);
+		snprintf((char *)cp, buflen, "%s%s", hbuf, cp2);
 		free(ep->value);
 		ep->value = (unsigned char *)cp;
 	}

Modified: stable/12/contrib/telnet/telnet/telnet.c
==============================================================================
--- stable/12/contrib/telnet/telnet/telnet.c	Fri Jul 19 15:24:08 2019	(r350138)
+++ stable/12/contrib/telnet/telnet/telnet.c	Fri Jul 19 15:37:29 2019	(r350139)
@@ -785,7 +785,7 @@ suboption(void)
 	    name = gettermname();
 	    len = strlen(name) + 4 + 2;
 	    if (len < NETROOM()) {
-		sprintf(temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
+		snprintf(temp, sizeof(temp), "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
 				TELQUAL_IS, name, IAC, SE);
 		ring_supply_data(&netoring, temp, len);
 		printsub('>', &temp[2], len-2);
@@ -807,7 +807,7 @@ suboption(void)
 
 	    TerminalSpeeds(&ispeed, &ospeed);
 
-	    sprintf((char *)temp, "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
+	    snprintf((char *)temp, sizeof(temp), "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
 		    TELQUAL_IS, ospeed, ispeed, IAC, SE);
 	    len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */
 

Modified: stable/12/contrib/telnet/telnet/utilities.c
==============================================================================
--- stable/12/contrib/telnet/telnet/utilities.c	Fri Jul 19 15:24:08 2019	(r350138)
+++ stable/12/contrib/telnet/telnet/utilities.c	Fri Jul 19 15:37:29 2019	(r350139)
@@ -629,7 +629,7 @@ printsub(char direction, unsigned char *pointer, int l
 		}
 		{
 		    char tbuf[64];
-		    sprintf(tbuf, "%s%s%s%s%s",
+		    snprintf(tbuf, sizeof(tbuf), "%s%s%s%s%s",
 			pointer[2]&MODE_EDIT ? "|EDIT" : "",
 			pointer[2]&MODE_TRAPSIG ? "|TRAPSIG" : "",
 			pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",