>Number:         284
>Category:       bin
>Synopsis:       w may display garbage when ut_host contains a ':'
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    gnats-admin (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jun  8 07:05:02 1994
>Originator:     Jarle Greipsland
>Organization:
"Free Hardware Foundation, UnLtd."
>Release:        0.9b
>Environment:
	
System: NetBSD darling.idt.unit.no 0.9B NetBSD 0.9B (DARLING) #11: Thu Jun 2 12:37:26 MET DST 1994 jarle@darling.idt.unit.no:/usr/src/sys/arch/i386/compile/DARLING i386


>Description:
If an ut_host field in an utmp entry contains a ':' (e.g. for an xterm session)
w doesn't handle the non-'\0' terminated char arrays in struct utmp properly.
>How-To-Repeat:
Have a DISPLAY variable that's exactly 16 characters long, 
e.g. 129.241.111.50:0.  This will give a non-nullterminated array of chars in
utmp.ut_host.  w will then try to convert the IP-address into a hostname, and
if this hostname is a bit less than UT_HOSTSIZE, the snprintf-statement at line
310 will produce pc-e220-1:0<garbage here>.
	
>Fix:
Make sure that the chars used to print display number/screen number are all
from within the utmp.ut_host field.
Apply patch:

*** src/usr.bin/w/w.c	Wed Jun  8 15:15:01 1994
--- src/usr.bin/w/w.c.orig	Wed Jun  8 13:12:31 1994
***************
*** 308,313 ****
  		}
  		if (x) {
! 			(void)snprintf(buf, sizeof(buf), "%s:%.*s", p, 
! 		        ep->utmp.ut_host + UT_HOSTSIZE - x, x);
  			p = buf;
  		}
--- 308,312 ----
  		}
  		if (x) {
! 			(void)snprintf(buf, sizeof(buf), "%s:%s", p, x);
  			p = buf;
  		}
>Audit-Trail:
>Unformatted:


------------------------------------------------------------------------------