mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-17 10:26:15 +00:00
Code Issues Releases Activity

* Fix a segfault when timed(8) receives a packet with a bad tsp_type.

Browse Source 
* Check that received packets aren't too short, as this could cause other
  problems.

Reviewed by:	imp, markm
This commit is contained in:
Ben Smithurst 2000-12-28 19:50:07 +00:00
parent 9c0bdb861b
commit 5be8ff7bb5
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=70446
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
usr.sbin/timed/timed/readmsg.c
View File

@ -88,6 +88,7 @@ readmsg(type, machfrom, intvl, netfrom)
struct tsplist *prev; struct tsplist *prev;
register struct netinfo *ntp; register struct netinfo *ntp;
register struct tsplist *ptr; register struct tsplist *ptr;
ssize_t n;
if (trace) { if (trace) {
fprintf(fd, "readmsg: looking for %s from %s, %s\n", fprintf(fd, "readmsg: looking for %s from %s, %s\n",
@ -206,11 +207,18 @@ readmsg(type, machfrom, intvl, netfrom)
continue; continue;
} }
length = sizeof(from); length = sizeof(from);
if (recvfrom(sock, (char *)&msgin, sizeof(struct tsp), 0, if ((n = recvfrom(sock, (char *)&msgin, sizeof(struct tsp), 0,
(struct sockaddr*)&from, &length) < 0) { (struct sockaddr*)&from, &length)) < 0) {
syslog(LOG_ERR, "recvfrom: %m"); syslog(LOG_ERR, "recvfrom: %m");
exit(1); exit(1);
} }
if (n < (ssize_t)sizeof(struct tsp)) {
syslog(LOG_NOTICE,
"short packet (%u/%u bytes) from %s",
n, sizeof(struct tsp),
inet_ntoa(from.sin_addr));
continue;
}
(void)gettimeofday(&from_when, (struct timezone *)0); (void)gettimeofday(&from_when, (struct timezone *)0);
bytehostorder(&msgin); bytehostorder(&msgin);
@ -436,6 +444,13 @@ print(msg, addr)
{ {
char tm[26]; char tm[26];
time_t tsp_time_sec; time_t tsp_time_sec;
if (msg->tsp_type >= TSPTYPENUMBER) {
fprintf(fd, "bad type (%u) on packet from %s\n",
msg->tsp_type, inet_ntoa(addr->sin_addr));
return;
}
switch (msg->tsp_type) { switch (msg->tsp_type) {
case TSP_LOOP: case TSP_LOOP: