Re: Final Patch for Review (was Re: [CFR] whois(1) out-of-bound access patch)

2001-10-08 Thread Chris Costello
On Sunday, October 07, 2001, Mike Barcroft wrote: > for (i = 0; ip_whois[i] != NULL; i++) { > - if (strstr(buf, ip_whois[i]) == NULL) > + if (strnstr(buf, ip_whois[i], len) == > +

Final Patch for Review (was Re: [CFR] whois(1) out-of-bound access patch)

2001-10-07 Thread Mike Barcroft
Todd C. Miller <[EMAIL PROTECTED]> writes: > In message <[EMAIL PROTECTED]> > so spake Mike Barcroft (mike): > > > Would you please test the attached patch and confirm that it solves > > the problem? If it does, I'll commit it today. > > I doubt that is sufficient as "buf" is treated as a

Re: [CFR] whois(1) out-of-bound access patch

2001-10-07 Thread Andrey A. Chernov
On Sun, Oct 07, 2001 at 13:37:16 -0400, Mike Barcroft wrote: > > > > Must be isspace((unsigned char)) > > Why and where can I find documentation about this? isspace(3) -- Andrey A. Chernov http://ache.pp.ru/ To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-net" in

Re: [CFR] whois(1) out-of-bound access patch

2001-10-07 Thread Dag-Erling Smorgrav
Mike Barcroft <[EMAIL PROTECTED]> writes: > Andrey A. Chernov <[EMAIL PROTECTED]> writes: > > On Thu, Oct 04, 2001 at 12:16:40 +0300, Peter Pentchev wrote: > > > + if ((len == 0) || !isspace(buf[len - 1])) { > > Must be isspace((unsigned char)) > Why and where can I find documentation

Re: [CFR] whois(1) out-of-bound access patch

2001-10-07 Thread Mike Barcroft
Andrey A. Chernov <[EMAIL PROTECTED]> writes: > On Thu, Oct 04, 2001 at 12:16:40 +0300, Peter Pentchev wrote: > > + if ((len == 0) || !isspace(buf[len - 1])) { > > Must be isspace((unsigned char)) Why and where can I find documentation about this? Best regards, Mike Barcroft To U

Re: [CFR] whois(1) out-of-bound access patch

2001-10-04 Thread Peter Pentchev
On Thu, Oct 04, 2001 at 01:02:56PM -0400, Garrett Wollman wrote: > < said: > > > - printf("%s\n", buf); > > + printf("%.*s\n", (int)len, buf); > > This is a *much* better patch. ..yet it needs more work: strstr() and strcspn() are used on a non-null-terminated string. And e

Re: [CFR] whois(1) out-of-bound access patch

2001-10-04 Thread Peter Pentchev
On Thu, Oct 04, 2001 at 01:47:10PM -0400, Mike Barcroft wrote: > Todd C. Miller <[EMAIL PROTECTED]> writes: > > In message <[EMAIL PROTECTED]> > > so spake Mike Barcroft (mike): > > > > > Would you please test the attached patch and confirm that it solves > > > the problem? If it does, I'll

Re: [CFR] whois(1) out-of-bound access patch

2001-10-04 Thread Mike Barcroft
Todd C. Miller <[EMAIL PROTECTED]> writes: > In message <[EMAIL PROTECTED]> > so spake Mike Barcroft (mike): > > > Would you please test the attached patch and confirm that it solves > > the problem? If it does, I'll commit it today. > > I doubt that is sufficient as "buf" is treated as a

Re: [CFR] whois(1) out-of-bound access patch

2001-10-04 Thread Garrett Wollman
< said: > - printf("%s\n", buf); > + printf("%.*s\n", (int)len, buf); This is a *much* better patch. -GAWollman To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-net" in the body of the message

Re: [CFR] whois(1) out-of-bound access patch

2001-10-04 Thread Todd C. Miller
In message <[EMAIL PROTECTED]> so spake Mike Barcroft (mike): > Would you please test the attached patch and confirm that it solves > the problem? If it does, I'll commit it today. I doubt that is sufficient as "buf" is treated as a NUL terminated string in the calls to strstr(). Also

Re: [CFR] whois(1) out-of-bound access patch

2001-10-04 Thread Mike Barcroft
Peter Pentchev <[EMAIL PROTECTED]> writes: > As described in PR bin/30968, whois(1) may access invalid data when > the whois server returns a non-newline-terminated string. > While it is true that the whois server maintainers should do a better > job of following standards and such, still the 'be

Re: [CFR] whois(1) out-of-bound access patch

2001-10-04 Thread Peter Pentchev
On Thu, Oct 04, 2001 at 01:28:02PM +0400, Andrey A. Chernov wrote: > On Thu, Oct 04, 2001 at 12:16:40 +0300, Peter Pentchev wrote: > > + if ((len == 0) || !isspace(buf[len - 1])) { > > Must be isspace((unsigned char)) On Thu, Oct 04, 2001 at 01:30:42PM +0400, Andre

Re: [CFR] whois(1) out-of-bound access patch

2001-10-04 Thread Andrey A. Chernov
On Thu, Oct 04, 2001 at 12:16:40 +0300, Peter Pentchev wrote: > + abuf = calloc(1, len + 1); > + if (abuf == NULL) { > + errno = ENOMEM; > + err(1, "reallocating"); > + } To overwri

Re: [CFR] whois(1) out-of-bound access patch

2001-10-04 Thread Andrey A. Chernov
On Thu, Oct 04, 2001 at 12:16:40 +0300, Peter Pentchev wrote: > + if ((len == 0) || !isspace(buf[len - 1])) { Must be isspace((unsigned char)) -- Andrey A. Chernov http://ache.pp.ru/ To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-net" in the body of t

[CFR] whois(1) out-of-bound access patch

2001-10-04 Thread Peter Pentchev
Hi, As described in PR bin/30968, whois(1) may access invalid data when the whois server returns a non-newline-terminated string. While it is true that the whois server maintainers should do a better job of following standards and such, still the 'be liberal in what you accept' mindset might be a