9fans - fans of the OS Plan 9 from Bell Labs
 help / color / mirror / Atom feed
From: forsyth@plan9.cs.york.ac.uk forsyth@plan9.cs.york.ac.uk
Subject: fix to /sys/src/libc/port/dial.c
Date: Wed,  9 Oct 1996 17:40:40 +0100	[thread overview]
Message-ID: <19961009164040.SoswXKv8Jk6NSQ4r3oETVfoFPzIIitCULbmbIMnUWUk@z> (raw)

errstr changed between editions so that it now exchanges the
contents of the two buffers.  dial.c wasn't changed accordingly, but
there is at least one path through dial where errstr can be called
with an uninitialised byte array, which is copied into the process's
error string.  (specifically, if ndb/cs doesn't return anything.)
ordinarily, that does no great harm, but if there is a % in the rubbish,
it causes trouble: the string is fetched by a later errstr, then
passed to werrstr as a format, in which % can cause various kinds of havoc.
ndb/dns can blow up, for instance.

the simple fix is to ensure that errstr's argument buffer is initialised,
and use errstr not werrstr to set the string in some cases.
i changed a few sprint to snprint while i was at it, just in case,
and initialised a default error message in one case.

a boddle file is in ftp://ftp.cs.york.ac.uk/plan9/bod/dial.bod.
here are some diffs.

term% diff /n/cd/libc/port/dial.c /sys/src/libc/port/dial.c
51a52
> 	err[0] = 0;
54c55
< 		werrstr(err);
---
> 		errstr(err);
62a64
> 	alterr[0] = 0;
65c67
< 		werrstr(err);
---
> 		errstr(err);
67c69
< 		werrstr(alterr);
---
> 		errstr(alterr);
95c97
< 	sprint(buf, "%s!%s", ds->proto, ds->rem);
---
> 	snprint(buf, sizeof(buf), "%s!%s", ds->proto, ds->rem);
105a108
> 	snprint(err, sizeof(err), "%s: can't translate address", buf);
117a121
> 		err[0] = 0;
125c129
< 		werrstr(besterr);
---
> 		errstr(besterr);
127c131
< 		werrstr(err);
---
> 		errstr(err);




                 reply	other threads:[~1996-10-09 16:40 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=19961009164040.SoswXKv8Jk6NSQ4r3oETVfoFPzIIitCULbmbIMnUWUk@z \
    --to=forsyth@plan9.cs.york.ac.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).