[CFR] whois(1) out-of-bound access patch

[Peter Pentchev]

Hi,

As described in PR bin/30968, whois(1) may access invalid data when
the whois server returns a non-newline-terminated string.
While it is true that the whois server maintainers should do a better
job of following standards and such, still the 'be liberal in what
you accept' mindset might be applied in this case, to fix what is
ultimately a subtle fgetln(3) use bug :)

Any harm in committing the attached patch?  And this - or something
like this - should be done soon; all FreeBSD whois clients currently
display weird behavior when querying .biz domains :\

G'luck,
Peter

-- 
because I didn't think of a good beginning of it.

Index: src/usr.bin/whois/whois.c
===================================================================
RCS file: /home/ncvs/src/usr.bin/whois/whois.c,v
retrieving revision 1.24
diff -u -r1.24 whois.c
--- src/usr.bin/whois/whois.c   2001/08/05 19:37:12     1.24
+++ src/usr.bin/whois/whois.c   2001/10/04 14:03:33
@@ -51,6 +51,7 @@
 #include <arpa/inet.h>
 #include <ctype.h>
 #include <err.h>
+#include <errno.h>
 #include <netdb.h>
 #include <stdarg.h>
 #include <stdio.h>
@@ -251,7 +252,7 @@
 {
        FILE *sfi, *sfo;
        struct addrinfo *res2;
-       char *buf, *nhost, *p;
+       char *abuf, *buf, *nhost, *p;
        int i, nomatch, s;
        size_t len;
 
@@ -275,6 +276,16 @@
        nhost = NULL;
        nomatch = 0;
        while ((buf = fgetln(sfi, &len)) != NULL) {
+               abuf = NULL;
+               if ((len == 0) || !isspace(buf[len - 1])) {
+                       abuf = calloc(1, len + 1);
+                       if (abuf == NULL) {
+                               errno = ENOMEM;
+                               err(1, "reallocating");
+                       }
+                       memcpy(abuf, buf, len);
+                       buf = abuf;
+               }
                while (len && isspace(buf[len - 1]))
                        buf[--len] = '\0';
 
@@ -304,6 +315,7 @@
                                nomatch = 1;
                }
                printf("%s\n", buf);
+               free(abuf);
        }
 
        /* Do second lookup as needed. */

To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-net" in the body of the message