Re: bin/45662: Overlapping buffer in lpd_command.c.

[henning petersen <henning.petersen%t-online.de@localhost>]

The following reply was made to PR bin/45662; it has been noted by GNATS.

From: henning petersen <henning.petersen%t-online.de@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: bin/45662: Overlapping buffer in lpd_command.c.
Date: Mon, 05 Dec 2011 11:12:02 +0100

 This is a multi-part message in MIME format.
 --------------080607040907030007050007
 Content-Type: text/plain; charset=ISO-8859-15
 Content-Transfer-Encoding: 7bit
 
 Am 27.11.2011 13:10, schrieb Christian Biere:
 > The following reply was made to PR bin/45662; it has been noted by GNATS.
 >
 > From: Christian Biere <christianbiere%gmx.de@localhost>
 > To: gnats-bugs%NetBSD.org@localhost
 > Cc: 
 > Subject: Re: bin/45662: Overlapping buffer in lpd_command.c.
 > Date: Sun, 27 Nov 2011 13:06:31 +0100
 >
 >  I suggest just merging the two snprintf() calls instead to avoid
 >  any pointer arithmetic with the destination buffer.
 >  
 >  --- ldp_command.c.orig      2011-11-27 12:53:00.338002396 +0100
 >  +++ ldp_command.c   2011-11-27 12:57:08.228002423 +0100
 >  @@ -486,10 +486,9 @@ show_labels(int s, char *recvspace)
 >              if (p->state != LDP_PEER_ESTABLISHED)
 >                      continue;
 >              SLIST_FOREACH(lm, &p->label_mapping_head, mappings) {
 >  -                   snprintf(sendspace, MAXSEND, "%s:%d",
 >  -                       inet_ntoa(p->ldp_id), lm->label);
 >  -                   snprintf(sendspace, MAXSEND, "%s\t%s/%d\n",
 >  -                       sendspace, inet_ntoa(lm->address), lm->prefix);
 >  +                   snprintf(sendspace, MAXSEND, "%s:%d\t%s/%d\n",
 >  +                       inet_ntoa(p->ldp_id), lm->label,
 >  +                       inet_ntoa(lm->address), lm->prefix);
 >                      writestr(s, sendspace);
 >              }
 >      }
 >  
 >
 OK Attach is the new patch.
 
 --------------080607040907030007050007
 Content-Type: text/plain;
  name="ldp_command.c.diff"
 Content-Transfer-Encoding: 7bit
 Content-Disposition: attachment;
  filename="ldp_command.c.diff"
 
 diff -u -p -r1.5 ldp_command.c
 --- usr.sbin/ldpd/ldp_command.c        16 Jun 2011 08:27:28 -0000      1.5
 +++ usr.sbin/ldpd/ldp_command.c        27 Nov 2011 17:52:42 -0000
 @@ -486,10 +486,10 @@ show_labels(int s, char *recvspace)
                if (p->state != LDP_PEER_ESTABLISHED)
                        continue;
                SLIST_FOREACH(lm, &p->label_mapping_head, mappings) {
 -                      snprintf(sendspace, MAXSEND, "%s:%d",
 -                          inet_ntoa(p->ldp_id), lm->label);
 -                      snprintf(sendspace, MAXSEND, "%s\t%s/%d\n",
 -                          sendspace, inet_ntoa(lm->address), lm->prefix);
 +                      snprintf(sendspace, MAXSEND,
 +                              "%s:%d\t%s/%d\n",
 +                          inet_ntoa(p->ldp_id), lm->label,
 +                          inet_ntoa(lm->address), lm->prefix);
                        writestr(s, sendspace);
                }
        }
 
 --------------080607040907030007050007--