From daca86509208743b3b3dfd318fdf875882495973 Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@FreeBSD.org>
Date: Mon, 25 Aug 1997 05:02:11 +0000
Subject: [PATCH] Change from using sys/param.h and MAXPATHLEN to using
 limits.h and PATH_MAX to avoid the NOFILE problem.  Back out NOFILE kludge. 
 Fix unexploitable buffer overflow in tipout.c. Reviewed by:
 millert@openbsd.org (tipout.c) Submitted by:	millert@openbsd.org (rest of
 idea)

---
 usr.bin/tip/tip/cmds.c   | 4 ++--
 usr.bin/tip/tip/tip.c    | 6 +++---
 usr.bin/tip/tip/tip.h    | 8 ++++----
 usr.bin/tip/tip/tipout.c | 4 ++--
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/usr.bin/tip/tip/cmds.c b/usr.bin/tip/tip/cmds.c
index 335763ebebf..7a9f2d88d51 100644
--- a/usr.bin/tip/tip/cmds.c
+++ b/usr.bin/tip/tip/cmds.c
@@ -36,7 +36,7 @@
 static char sccsid[] = "@(#)cmds.c	8.1 (Berkeley) 6/6/93";
 #endif
 static const char rcsid[] =
-	"$Id: cmds.c,v 1.3 1997/08/18 07:16:00 charnier Exp $";
+	"$Id: cmds.c,v 1.4 1997/08/22 22:14:15 imp Exp $";
 #endif /* not lint */
 
 #include "tipconf.h"
@@ -787,7 +787,7 @@ setscript()
 void
 chdirectory()
 {
-	char dirname[MAXPATHLEN];
+	char dirname[PATH_MAX];
 	register char *cp = dirname;
 
 	if (prompt("[cd] ", dirname, sizeof(dirname))) {
diff --git a/usr.bin/tip/tip/tip.c b/usr.bin/tip/tip/tip.c
index 1ddaa641899..61726af03e3 100644
--- a/usr.bin/tip/tip/tip.c
+++ b/usr.bin/tip/tip/tip.c
@@ -42,7 +42,7 @@ static const char copyright[] =
 static char sccsid[] = "@(#)tip.c	8.1 (Berkeley) 6/6/93";
 #endif
 static const char rcsid[] =
-	"$Id: tip.c,v 1.3 1997/08/18 07:16:06 charnier Exp $";
+	"$Id: tip.c,v 1.4 1997/08/22 22:14:15 imp Exp $";
 #endif /* not lint */
 
 /*
@@ -88,7 +88,7 @@ void setparity __P((char *));
 void pwrite __P((int, char *, int));
 char escape __P((void));
 void tipin __P((void));
-int prompt __P((char *, char *, int));
+int prompt __P((char *, char *, size_t));
 void unraw __P((void));
 void shell_uid __P((void));
 void daemon_uid __P((void));
@@ -380,7 +380,7 @@ int
 prompt(s, p, sz)
 	char *s;
 	register char *p;
-	int sz;
+	size_t sz;
 {
 	register char *b = p;
 	sig_t oint, oquit;
diff --git a/usr.bin/tip/tip/tip.h b/usr.bin/tip/tip/tip.h
index fb7e6dbd904..759c1540565 100644
--- a/usr.bin/tip/tip/tip.h
+++ b/usr.bin/tip/tip/tip.h
@@ -42,7 +42,7 @@
 #include <machine/endian.h>
 #include <sys/file.h>
 #include <sys/time.h>
-#include <sys/param.h>
+#include <limits.h>
 
 #if HAVE_TERMIOS
 #include <sys/ioctl.h>         /* for TIOCHPCL */
@@ -290,8 +290,8 @@ int	stoprompt;		/* for interrupting a prompt session */
 int	timedout;		/* ~> transfer timedout */
 int	cumode;			/* simulating the "cu" program */
 
-char	fname[MAXPATHLEN];	/* file name buffer for ~< */
-char	copyname[MAXPATHLEN];	/* file name buffer for ~> */
+char	fname[PATH_MAX];	/* file name buffer for ~< */
+char	copyname[PATH_MAX];	/* file name buffer for ~> */
 char	ccc;			/* synchronization character */
 char	ch;			/* for tipout */
 char	*uucplock;		/* name of lock file for uucp's */
@@ -317,7 +317,7 @@ extern	void disconnect __P((char *));
 extern	void shell_uid __P((void));
 extern	void unraw __P((void));
 extern	void pwrite __P((int, char *, int));
-extern	int prompt __P((char *, char *, int));
+extern	int prompt __P((char *, char *, size_t));
 extern	void  consh __P((int));
 extern	void tipabort __P((char *));
 
diff --git a/usr.bin/tip/tip/tipout.c b/usr.bin/tip/tip/tipout.c
index 50cbb7c3eb7..d9417d68602 100644
--- a/usr.bin/tip/tip/tipout.c
+++ b/usr.bin/tip/tip/tipout.c
@@ -36,7 +36,7 @@
 static char sccsid[] = "@(#)tipout.c	8.1 (Berkeley) 6/6/93";
 #endif
 static const char rcsid[] =
-	"$Id$";
+	"$Id: tipout.c,v 1.4 1997/08/18 07:16:08 charnier Exp $";
 #endif /* not lint */
 
 #include "tip.h"
@@ -74,7 +74,7 @@ intEMT()
 	char reply;
 
 	read(fildes[0], &c, 1);
-	while (c != '\n') {
+	while (c != '\n' && pline - line < sizeof(line)) {
 		*pline++ = c;
 		read(fildes[0], &c, 1);
 	}