123456789101112131415161718192021222324252627282930313233343536373839404142 |
- Description: Fix parsing of lines longer than 2047 characters
- If a line in /etc/hosts.{allow,deny} is longer than BUFLEN-1 (2047)
- characters then len will be set to 1 at the end of the xgets() loop.
- .
- At the next iteration, fgets will be passed a buffer of length 1, so it
- will only be able to read an empty string (the buffer must always have
- space for the trailing NUL).
- .
- strlen(3) on the empty string will return 0, so len will not be modified
- anymore and the last step will repeat forever.
- .
- To reproduce:
- perl -e 'print "#sshd: " . ("127.0.0.1, " x 210) . "\n"' > hosts.deny
- tcpdmatch -d test localhost
- Author: Marco d'Itri <md@linux.it>
- Bug-Debian: http://bugs.debian.org/596261
- --- a/misc.c
- +++ b/misc.c
- @@ -45,6 +45,8 @@ FILE *fp;
- }
- ptr += got;
- len -= got;
- + if (len == 1)
- + return(start);
- ptr[0] = 0;
- }
- return (ptr > start ? start : 0);
- --- a/hosts_access.c
- +++ b/hosts_access.c
- @@ -165,7 +165,9 @@ struct request_info *request;
- while (match == NO && xgets(sv_list, sizeof(sv_list), fp) != 0) {
- if (sv_list[strlen(sv_list) - 1] != '\n') {
- tcpd_warn("missing newline or line too long");
- - continue;
- + tcpd_warn("all the subsequent rules will be ignored");
- + match = ERR;
- + break;
- }
- if (sv_list[0] == '#' || sv_list[strspn(sv_list, " \t\r\n")] == 0)
- continue;
|