svn commit: r350281 - in releng: 11.2/contrib/telnet/telnet 11.3/contrib/telnet/telnet 12.0/contrib/telnet/telnet
Gordon Tetlow
gordon at FreeBSD.org
Wed Jul 24 12:51:54 UTC 2019
Author: gordon
Date: Wed Jul 24 12:51:52 2019
New Revision: 350281
URL: https://svnweb.freebsd.org/changeset/base/350281
Log:
Fix multiple telnet client vulnerabilities.
Approved by: so
Security: FreeBSD-SA-19:12.telnet
Security: CVE-2019-0053
Modified:
releng/11.2/contrib/telnet/telnet/commands.c
releng/11.2/contrib/telnet/telnet/telnet.c
releng/11.2/contrib/telnet/telnet/utilities.c
releng/11.3/contrib/telnet/telnet/commands.c
releng/11.3/contrib/telnet/telnet/telnet.c
releng/11.3/contrib/telnet/telnet/utilities.c
releng/12.0/contrib/telnet/telnet/commands.c
releng/12.0/contrib/telnet/telnet/telnet.c
releng/12.0/contrib/telnet/telnet/utilities.c
Modified: releng/11.2/contrib/telnet/telnet/commands.c
==============================================================================
--- releng/11.2/contrib/telnet/telnet/commands.c Wed Jul 24 12:50:46 2019 (r350280)
+++ releng/11.2/contrib/telnet/telnet/commands.c Wed Jul 24 12:51:52 2019 (r350281)
@@ -45,6 +45,7 @@ __FBSDID("$FreeBSD$");
#include <sys/socket.h>
#include <netinet/in.h>
+#include <assert.h>
#include <ctype.h>
#include <err.h>
#include <errno.h>
@@ -1654,11 +1655,14 @@ env_init(void)
|| (strncmp((char *)ep->value, "unix:", 5) == 0))) {
char hbuf[256+1];
char *cp2 = strchr((char *)ep->value, ':');
+ size_t buflen;
- gethostname(hbuf, 256);
- hbuf[256] = '\0';
- cp = (char *)malloc(strlen(hbuf) + strlen(cp2) + 1);
- sprintf((char *)cp, "%s%s", hbuf, cp2);
+ gethostname(hbuf, sizeof(hbuf));
+ hbuf[sizeof(hbuf)-1] = '\0';
+ buflen = strlen(hbuf) + strlen(cp2) + 1;
+ cp = (char *)malloc(sizeof(char)*buflen);
+ assert(cp != NULL);
+ snprintf((char *)cp, buflen, "%s%s", hbuf, cp2);
free(ep->value);
ep->value = (unsigned char *)cp;
}
Modified: releng/11.2/contrib/telnet/telnet/telnet.c
==============================================================================
--- releng/11.2/contrib/telnet/telnet/telnet.c Wed Jul 24 12:50:46 2019 (r350280)
+++ releng/11.2/contrib/telnet/telnet/telnet.c Wed Jul 24 12:51:52 2019 (r350281)
@@ -785,7 +785,7 @@ suboption(void)
name = gettermname();
len = strlen(name) + 4 + 2;
if (len < NETROOM()) {
- sprintf(temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
+ snprintf(temp, sizeof(temp), "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
TELQUAL_IS, name, IAC, SE);
ring_supply_data(&netoring, temp, len);
printsub('>', &temp[2], len-2);
@@ -807,7 +807,7 @@ suboption(void)
TerminalSpeeds(&ispeed, &ospeed);
- sprintf((char *)temp, "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
+ snprintf((char *)temp, sizeof(temp), "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
TELQUAL_IS, ospeed, ispeed, IAC, SE);
len = strlen((char *)temp+4) + 4; /* temp[3] is 0 ... */
Modified: releng/11.2/contrib/telnet/telnet/utilities.c
==============================================================================
--- releng/11.2/contrib/telnet/telnet/utilities.c Wed Jul 24 12:50:46 2019 (r350280)
+++ releng/11.2/contrib/telnet/telnet/utilities.c Wed Jul 24 12:51:52 2019 (r350281)
@@ -629,7 +629,7 @@ printsub(char direction, unsigned char *pointer, int l
}
{
char tbuf[64];
- sprintf(tbuf, "%s%s%s%s%s",
+ snprintf(tbuf, sizeof(tbuf), "%s%s%s%s%s",
pointer[2]&MODE_EDIT ? "|EDIT" : "",
pointer[2]&MODE_TRAPSIG ? "|TRAPSIG" : "",
pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",
Modified: releng/11.3/contrib/telnet/telnet/commands.c
==============================================================================
--- releng/11.3/contrib/telnet/telnet/commands.c Wed Jul 24 12:50:46 2019 (r350280)
+++ releng/11.3/contrib/telnet/telnet/commands.c Wed Jul 24 12:51:52 2019 (r350281)
@@ -45,6 +45,7 @@ __FBSDID("$FreeBSD$");
#include <sys/socket.h>
#include <netinet/in.h>
+#include <assert.h>
#include <ctype.h>
#include <err.h>
#include <errno.h>
@@ -1654,11 +1655,14 @@ env_init(void)
|| (strncmp((char *)ep->value, "unix:", 5) == 0))) {
char hbuf[256+1];
char *cp2 = strchr((char *)ep->value, ':');
+ size_t buflen;
- gethostname(hbuf, 256);
- hbuf[256] = '\0';
- cp = (char *)malloc(strlen(hbuf) + strlen(cp2) + 1);
- sprintf((char *)cp, "%s%s", hbuf, cp2);
+ gethostname(hbuf, sizeof(hbuf));
+ hbuf[sizeof(hbuf)-1] = '\0';
+ buflen = strlen(hbuf) + strlen(cp2) + 1;
+ cp = (char *)malloc(sizeof(char)*buflen);
+ assert(cp != NULL);
+ snprintf((char *)cp, buflen, "%s%s", hbuf, cp2);
free(ep->value);
ep->value = (unsigned char *)cp;
}
Modified: releng/11.3/contrib/telnet/telnet/telnet.c
==============================================================================
--- releng/11.3/contrib/telnet/telnet/telnet.c Wed Jul 24 12:50:46 2019 (r350280)
+++ releng/11.3/contrib/telnet/telnet/telnet.c Wed Jul 24 12:51:52 2019 (r350281)
@@ -785,7 +785,7 @@ suboption(void)
name = gettermname();
len = strlen(name) + 4 + 2;
if (len < NETROOM()) {
- sprintf(temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
+ snprintf(temp, sizeof(temp), "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
TELQUAL_IS, name, IAC, SE);
ring_supply_data(&netoring, temp, len);
printsub('>', &temp[2], len-2);
@@ -807,7 +807,7 @@ suboption(void)
TerminalSpeeds(&ispeed, &ospeed);
- sprintf((char *)temp, "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
+ snprintf((char *)temp, sizeof(temp), "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
TELQUAL_IS, ospeed, ispeed, IAC, SE);
len = strlen((char *)temp+4) + 4; /* temp[3] is 0 ... */
Modified: releng/11.3/contrib/telnet/telnet/utilities.c
==============================================================================
--- releng/11.3/contrib/telnet/telnet/utilities.c Wed Jul 24 12:50:46 2019 (r350280)
+++ releng/11.3/contrib/telnet/telnet/utilities.c Wed Jul 24 12:51:52 2019 (r350281)
@@ -629,7 +629,7 @@ printsub(char direction, unsigned char *pointer, int l
}
{
char tbuf[64];
- sprintf(tbuf, "%s%s%s%s%s",
+ snprintf(tbuf, sizeof(tbuf), "%s%s%s%s%s",
pointer[2]&MODE_EDIT ? "|EDIT" : "",
pointer[2]&MODE_TRAPSIG ? "|TRAPSIG" : "",
pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",
Modified: releng/12.0/contrib/telnet/telnet/commands.c
==============================================================================
--- releng/12.0/contrib/telnet/telnet/commands.c Wed Jul 24 12:50:46 2019 (r350280)
+++ releng/12.0/contrib/telnet/telnet/commands.c Wed Jul 24 12:51:52 2019 (r350281)
@@ -45,6 +45,7 @@ __FBSDID("$FreeBSD$");
#include <sys/socket.h>
#include <netinet/in.h>
+#include <assert.h>
#include <ctype.h>
#include <err.h>
#include <errno.h>
@@ -1654,11 +1655,14 @@ env_init(void)
|| (strncmp((char *)ep->value, "unix:", 5) == 0))) {
char hbuf[256+1];
char *cp2 = strchr((char *)ep->value, ':');
+ size_t buflen;
- gethostname(hbuf, 256);
- hbuf[256] = '\0';
- cp = (char *)malloc(strlen(hbuf) + strlen(cp2) + 1);
- sprintf((char *)cp, "%s%s", hbuf, cp2);
+ gethostname(hbuf, sizeof(hbuf));
+ hbuf[sizeof(hbuf)-1] = '\0';
+ buflen = strlen(hbuf) + strlen(cp2) + 1;
+ cp = (char *)malloc(sizeof(char)*buflen);
+ assert(cp != NULL);
+ snprintf((char *)cp, buflen, "%s%s", hbuf, cp2);
free(ep->value);
ep->value = (unsigned char *)cp;
}
Modified: releng/12.0/contrib/telnet/telnet/telnet.c
==============================================================================
--- releng/12.0/contrib/telnet/telnet/telnet.c Wed Jul 24 12:50:46 2019 (r350280)
+++ releng/12.0/contrib/telnet/telnet/telnet.c Wed Jul 24 12:51:52 2019 (r350281)
@@ -785,7 +785,7 @@ suboption(void)
name = gettermname();
len = strlen(name) + 4 + 2;
if (len < NETROOM()) {
- sprintf(temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
+ snprintf(temp, sizeof(temp), "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
TELQUAL_IS, name, IAC, SE);
ring_supply_data(&netoring, temp, len);
printsub('>', &temp[2], len-2);
@@ -807,7 +807,7 @@ suboption(void)
TerminalSpeeds(&ispeed, &ospeed);
- sprintf((char *)temp, "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
+ snprintf((char *)temp, sizeof(temp), "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
TELQUAL_IS, ospeed, ispeed, IAC, SE);
len = strlen((char *)temp+4) + 4; /* temp[3] is 0 ... */
Modified: releng/12.0/contrib/telnet/telnet/utilities.c
==============================================================================
--- releng/12.0/contrib/telnet/telnet/utilities.c Wed Jul 24 12:50:46 2019 (r350280)
+++ releng/12.0/contrib/telnet/telnet/utilities.c Wed Jul 24 12:51:52 2019 (r350281)
@@ -629,7 +629,7 @@ printsub(char direction, unsigned char *pointer, int l
}
{
char tbuf[64];
- sprintf(tbuf, "%s%s%s%s%s",
+ snprintf(tbuf, sizeof(tbuf), "%s%s%s%s%s",
pointer[2]&MODE_EDIT ? "|EDIT" : "",
pointer[2]&MODE_TRAPSIG ? "|TRAPSIG" : "",
pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",
More information about the svn-src-releng
mailing list