NetBSD Problem Report #2684

From gnats  Sat Aug 10 09:00:07 1996
Received: from mail.ba2.so-net.or.jp by pain.lcs.mit.edu (8.7.5/8.7.3) with ESMTP id IAA26945 for <gnats-bugs@gnats.netbsd.org>; Sat, 10 Aug 1996 08:51:58 -0400 (EDT)
Message-Id: <199608101251.VAA03190@plants-doll.enami.ba2.so-net.or.jp>
Date: Sat, 10 Aug 1996 21:51:22 +0900 (JST)
From: enami@ba2.so-net.or.jp
Reply-To: enami@ba2.so-net.or.jp
To: gnats-bugs@NetBSD.ORG
Subject: rlogin passes wrong termianl speed; pass 960 if 9600.
X-Send-Pr-Version: 3.95

>Number:         2684
>Category:       bin
>Synopsis:       rlogin passes wrong termianl speed; pass 960 if 9600.
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    explorer
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 10 09:05:01 +0000 1996
>Closed-Date:    Sat Aug 10 19:45:56 +0000 1996
>Last-Modified:  Sat Aug 10 19:46:55 +0000 1996
>Originator:     enami tsugutomo
>Release:        1.2_BETA
>Organization:
	I'm now at home
>Environment:
System: NetBSD plants-doll.enami.ba2.so-net.or.jp 1.2_BETA NetBSD 1.2_BETA (PLANTS_DOLL) #180: Sat Jul 13 12:03:51 JST 1996 enami@plants-doll.enami.ba2.so-net.or.jp:/usr/src/sys/arch/i386/compile/PLANTS_DOLL i386
	(Don't worry, the kernel above is old but userland programs are
	up to date :).

>Description:
	If rlogin from NetBSD 1.2_BETA machine, tty speed passed to remote
	machine is wrong.  For example, when tty speed is 115200 on local
	machine, it become 11520 on remote machine.  If the remote machine
	is also NetBSD 1.2_BETA and do rlogin to another mahine, tty speed
	becomes 1152 on third mahine.

>How-To-Repeat:
	Just do rlogin and check terminal speed with stty.
>Fix:
	When passing tty speed, it was chaned to use snprintf but passed
	length doesn't includes trailing \0.  Actually, snprintf requires
	to include it.  Sample fix is appended.

enami.

Index: rlogin.c
===================================================================
RCS file: /a/cvsroot/NetBSD/usr.bin/rlogin/rlogin.c,v
retrieving revision 1.1.1.2
diff -u -r1.1.1.2 rlogin.c
--- rlogin.c	1996/08/01 14:33:44	1.1.1.2
+++ rlogin.c	1996/08/10 12:45:35
@@ -268,11 +268,11 @@
 	}
 	len = strlen(term);
 	if (len < (sizeof(term) - 1) && tcgetattr(0, &tty) == 0) {
-		/* start at 2 to include the / */
-		for (ospeed = i = cfgetospeed(&tty), len2 = 2; i > 9; len2++)
+		/* start at 3 to include the leading / and trailing \0. */
+		for (ospeed = i = cfgetospeed(&tty), len2 = 3; i > 9; len2++)
 			i /= 10;

-		if (len + len2 < sizeof(term) - 1)
+		if (len + len2 < sizeof(term))
 			(void)snprintf(term + len, len2, "/%d", ospeed);
 	}

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: explorer 
State-Changed-When: Sat Aug 10 15:45:56 EDT 1996 
State-Changed-Why:  
Fixed problem in an different way 


Responsible-Changed-From-To: bin-bug-people->explorer 
Responsible-Changed-By: explorer 
Responsible-Changed-When: Sat Aug 10 15:45:56 EDT 1996 
Responsible-Changed-Why:  
'cause I fixed it. 

From: Michael Graff <explorer@flame.org>
To: enami@ba2.so-net.or.jp
Cc: gnats-bugs@NetBSD.ORG
Subject: Re: bin/2684: rlogin passes wrong termianl speed; pass 960 if 9600.
Date: 10 Aug 1996 15:45:38 -0400

 enami@ba2.so-net.or.jp writes:

 > 	When passing tty speed, it was chaned to use snprintf but passed
 > 	length doesn't includes trailing \0.  Actually, snprintf requires
 > 	to include it.  Sample fix is appended.

 I fixed this in a different way.

 Since snprintf will write at most n - 1 characters, there needs to be
 exactly n characters left in the buffer.  The check len + len2
 assures this when len2 starts at 2, for the string "/1" for example.

 Here is the patch I applied.  I tested the buffer overflow before committing
 this, and it will not overflow.

 diff -u -r1.13 rlogin.c
 --- rlogin.c	1996/07/03 23:17:51	1.13
 +++ rlogin.c	1996/08/10 19:44:17
 @@ -272,8 +272,8 @@
  		for (ospeed = i = cfgetospeed(&tty), len2 = 2; i > 9; len2++)
  			i /= 10;

 -		if (len + len2 < sizeof(term) - 1)
 -			(void)snprintf(term + len, len2, "/%d", ospeed);
 +		if (len + len2 < sizeof(term))
 +			(void)snprintf(term + len, len2 + 1, "/%d", ospeed);
  	}

  	(void)get_window_size(0, &winsize);

 --Michael
>Unformatted:

Home	PR Database Search