[SCM] GNU Inetutils branch, master, updated. inetutils-1_8-148-g50d40fa

[Mats Erik Andersson]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU Inetutils ".

The branch, master has been updated
       via  50d40fa24a4238c0a0d0a775b8adc5f2dbb8c6d4 (commit)
      from  094ba8a78999a741759a7537b6fc980e5e3ce8ae (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
http://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=50d40fa24a4238c0a0d0a775b8adc5f2dbb8c6d4


commit 50d40fa24a4238c0a0d0a775b8adc5f2dbb8c6d4
Author: Mats Erik Andersson <address@hidden>
Date:   Wed Nov 9 22:46:45 2011 +0100

    syslogd: Prevent buffer overrun with socket names.

diff --git a/ChangeLog b/ChangeLog
index bd401db..3facf51 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2011-11-09  Mats Erik Andersson <address@hidden>
+
+       * src/syslogd.c (create_unix_socket): Avoid buffer
+       overrun for very long UNIX socket names.  Return proper
+       error codes also when bind() or chmod() fail.
+       * tests/syslogd.sh: Implement tests for the boundary
+       cases of very long UNIX socket names.
+
 2011-10-31  Simon Josefsson  <address@hidden>
 
        * doc/inetutils.texi (Top): Remove 'Concept Index'.  Doc fix.
diff --git a/src/syslogd.c b/src/syslogd.c
index ff83f4a..1e943ab 100644
--- a/src/syslogd.c
+++ b/src/syslogd.c
@@ -812,11 +812,18 @@ create_unix_socket (const char *path)
   if (path[0] == '\0')
     return -1;
 
+  if (strlen (path) >= sizeof (sunx.sun_path))
+    {
+      snprintf (line, sizeof (line), "UNIX socket name too long: %s", path);
+      logerror (line);
+      return -1;
+    }
+
   unlink (path);
 
   memset (&sunx, 0, sizeof (sunx));
   sunx.sun_family = AF_UNIX;
-  strncpy (sunx.sun_path, path, sizeof (sunx.sun_path));
+  strncpy (sunx.sun_path, path, sizeof (sunx.sun_path) - 1);
   fd = socket (AF_UNIX, SOCK_DGRAM, 0);
   if (fd < 0 || bind (fd, (struct sockaddr *) &sunx, SUN_LEN (&sunx)) < 0
       || chmod (path, 0666) < 0)
@@ -825,6 +832,7 @@ create_unix_socket (const char *path)
       logerror (line);
       dbg_printf ("cannot create %s: %s\n", path, strerror (errno));
       close (fd);
+      fd = -1;
     }
   return fd;
 }
diff --git a/tests/syslogd.sh b/tests/syslogd.sh
index 3d3f7b6..6550350 100755
--- a/tests/syslogd.sh
+++ b/tests/syslogd.sh
@@ -31,13 +31,43 @@ PID=$IU_TESTDIR/syslogd.pid
 OUT=$IU_TESTDIR/messages
 : ${SOCKET:=$IU_TESTDIR/log}
 
-IU_SYSLOGD=./src/syslogd$EXEEXT
-IU_LOGGER=./src/logger$EXEEXT
+# For testing of critical lengths for UNIX socket names,
+# we need a well defined base directory; choose "/tmp/".
+IU_TEN=0123456789
+IU_TWENTY=${IU_TEN}${IU_TEN}
+IU_FORTY=${IU_TWENTY}${IU_TWENTY}
+IU_EIGHTY=${IU_FORTY}${IU_FORTY}
+
+# This good name base consumes twentythree chracters.
+IU_GOOD_BASE=/tmp/$(date +%y-%m-%d)_socket_iu
+
+# Add a single character to violate the size condition.
+IU_BAD_BASE=/tmp/X$(date +%y-%m-%d)_socket_iu
+
+IU_OS=$(uname -s)
+if [ "${IU_OS}" != "OpenBSD" -a "${IU_OS}" != "FreeBSD" ]; then
+       # Aim at the boundary of 108 characters.
+       IU_GOOD_BASE=${IU_GOOD_BASE}_lnx
+       IU_BAD_BASE=${IU_BAD_BASE}_lnx
+fi
+
+# Establish largest possible socket name.  The long
+# name consists of 103 or 107 non-NUL characters,
+# where the excessive string contains 104 or 108.
+# BSD allocates only 104, whereas GLIBC and Solaris
+# admits 108 characters in "sun_path", including NUL.
+IU_LONG_SOCKET=${IU_GOOD_BASE}${IU_EIGHTY}
+IU_EXCESSIVE_SOCKET=${IU_BAD_BASE}${IU_EIGHTY}
 
 # All messages intended for post-detection are
 # to be uniformly tagged.
 TAG="syslogd-test"
 
+# The executables under test.
+
+IU_SYSLOGD=./src/syslogd$EXEEXT
+IU_LOGGER=./src/logger$EXEEXT
+
 # Step out of `tests/', should the invokation
 # have been made there.
 #
@@ -92,6 +122,8 @@ fi
 #
 ## Base configuration.
 IU_OPTIONS="--rcfile=$CONF --pidfile=$PID --socket=$SOCKET"
+IU_OPTIONS="$IU_OPTIONS -a $IU_LONG_SOCKET -a $IU_EXCESSIVE_SOCKET"
+
 ## Enable INET service when running as root.
 if [ "$USER" = "root" ]; then
        IU_OPTIONS="$IU_OPTIONS --ipany --inet --hop"
@@ -120,12 +152,20 @@ fi
 # as well as an exit code.
 #
 TESTCASES=0
+SUCCESSES=0
 EXITCODE=1
 
+# Check that the excessively long UNIX socket name was rejected.
+TESTCASES=$((TESTCASES + 1))
+if grep -q "UNIX socket name too long.*${IU_BAD_BASE}" $OUT; then
+       SUCCESSES="$((SUCCESSES + 1))"
+fi
+
 # Send messages on two sockets: IPv4 and UNIX.
 #
-TESTCASES=$((TESTCASES + 1))
+TESTCASES=$((TESTCASES + 2))
 $IU_LOGGER -h $SOCKET -p user.info -t $TAG "Sending BSD message. (pid $$)"
+$IU_LOGGER -h $IU_LONG_SOCKET -p user.info -t $TAG "Sending via long socket 
name. (pid $$)"
 
 if [ "$USER" = "root" ]; then
        TESTCASES=$((TESTCASES + 2))
@@ -135,15 +175,15 @@ fi
 
 # Detection of registered messages.
 #
-TEXTLINES="$(grep $TAG $OUT | wc -l)"
+SUCCESSES="$((SUCCESSES + $(grep $TAG $OUT | wc -l) ))"
 
 if [ -n "${VERBOSE+yes}" ]; then
        grep $TAG $OUT
 fi
 
-echo "Registered $TEXTLINES lines out of $TESTCASES."
+echo "Registered $SUCCESSES successes out of $TESTCASES."
 
-if [ "$TEXTLINES" -eq "$TESTCASES" ]; then
+if [ "$SUCCESSES" -eq "$TESTCASES" ]; then
        echo "Successful testing."
        EXITCODE=0
 else

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog        |    8 ++++++++
 src/syslogd.c    |   10 +++++++++-
 tests/syslogd.sh |   52 ++++++++++++++++++++++++++++++++++++++++++++++------
 3 files changed, 63 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
GNU Inetutils