[gentoo-commits] gentoo-x86 commit in app-forensics/chkrootkit/files: chkrootkit-0.48-chkutmp.c-some-overruns-fixes.patch

[gentoo-commits] gentoo-x86 commit in app-forensics/chkrootkit/files: chkrootkit-0.48-chkutmp.c-some-overruns-fixes.patch

[Peter Volkov (pva)]

pva         08/10/06 20:00:13

  Added:                chkrootkit-0.48-chkutmp.c-some-overruns-fixes.patch
  Log:
  Fixed chkutmp crash, bug #184962, thank barbaz for report and Stewart Gebbie for the fix.
  (Portage version: 2.2_rc11/cvs/Linux 2.6.26-gentoo-r1 i686)

Revision  Changes    Path
1.1                  app-forensics/chkrootkit/files/chkrootkit-0.48-chkutmp.c-some-overruns-fixes.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-forensics/chkrootkit/files/chkrootkit-0.48-chkutmp.c-some-overruns-fixes.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-forensics/chkrootkit/files/chkrootkit-0.48-chkutmp.c-some-overruns-fixes.patch?rev=1.1&content-type=text/plain

Index: chkrootkit-0.48-chkutmp.c-some-overruns-fixes.patch
===================================================================
=== modified file 'chkutmp.c'
--- chkutmp.c	2008-10-06 19:07:51 +0000
+++ chkutmp.c	2007-10-20 07:56:19 +0000
@@ -23,6 +23,7 @@
  *
  *  Changelog: 
  *   Ighighi X - Improved speed via break command - 2005/03/27 
+ *   Stewart Gebbie - fixed buffer overrun bug related to MAXREAD and UT_PIDLENGTH - 2007-10-20
  *  
  */
 
@@ -42,7 +43,7 @@
 #endif
 #include <ctype.h>
 
-#define MAXREAD 1024
+#define MAXREAD 4096
 #define MAXBUF 4096
 #define MAXLENGTH 256
 #define UT_PIDSIZE 12
@@ -57,13 +58,13 @@
 #endif
 
 struct ps_line {
-    char ps_tty[UT_LINESIZE];
-    char ps_user[UT_NAMESIZE];
-    char ps_args[MAXLENGTH];
+    char ps_tty[UT_LINESIZE+1];
+    char ps_user[UT_NAMESIZE+1];
+    char ps_args[MAXLENGTH+1];
     int ps_pid;
 };
 struct utmp_line {
-    char ut_tty[UT_LINESIZE];
+    char ut_tty[UT_LINESIZE+1];
     int ut_pid;
     int ut_type;
 };
@@ -77,7 +78,7 @@
 int fetchps(struct ps_line *psl_p)
 {
     FILE *ps_fp;
-    char line[MAXREAD + 1], pid[UT_PIDSIZE];
+    char line[MAXREAD + 1], pid[UT_PIDSIZE+1];
     char *s, *d;
     struct ps_line *curp = &psl_p[0];
     struct ps_line *endp = &psl_p[MAXBUF];
@@ -97,7 +98,7 @@
 		while (isspace(*s))	/* skip spaces */
 		    s++;
 		d = pid;
-		for (x = 0; (!isspace(*s)) && (*d++ = *s++) && x <= UT_LINESIZE; x++)	/* grab pid */
+		for (x = 0; (!isspace(*s)) && (*d++ = *s++) && x <= UT_PIDSIZE; x++)	/* grab pid */
 		    ;
 		*d = '\0';
 		curp->ps_pid = atoi(pid);