On Tue, Aug 19, 2014 at 01:59:42AM +0200, Alexander Bluhm wrote:
> I will split this diff into smaller parts to make review and
> discussion easier.
Instead of getting a nasty error message from privsep
syslogd: priv_getaddrinfo: overflow attempt in hostname
check the host and port length when parsing the config.
ok?
bluhm
Index: usr.sbin/syslogd/syslogd.c
===================================================================
RCS file: /cvs/src/usr.sbin/syslogd/syslogd.c,v
retrieving revision 1.116
diff -u -p -r1.116 syslogd.c
--- usr.sbin/syslogd/syslogd.c 21 Aug 2014 17:00:34 -0000 1.116
+++ usr.sbin/syslogd/syslogd.c 21 Aug 2014 20:10:41 -0000
@@ -1547,8 +1547,21 @@ cfline(char *line, char *prog)
logerror(ebuf);
break;
}
- if (priv_getaddrinfo(host,
- port == NULL ? "syslog" : port,
+ if (strlen(host) >= MAXHOSTNAMELEN) {
+ snprintf(ebuf, sizeof(ebuf), "host too long \"%s\"",
+ f->f_un.f_forw.f_loghost);
+ logerror(ebuf);
+ break;
+ }
+ if (port == NULL)
+ port = "syslog";
+ if (strlen(port) >= NI_MAXSERV) {
+ snprintf(ebuf, sizeof(ebuf), "port too long \"%s\"",
+ f->f_un.f_forw.f_loghost);
+ logerror(ebuf);
+ break;
+ }
+ if (priv_getaddrinfo(host, port,
(struct sockaddr*)&f->f_un.f_forw.f_addr,
sizeof(f->f_un.f_forw.f_addr)) != 0) {
snprintf(ebuf, sizeof(ebuf), "bad hostname \"%s\"",
