diff options
| author | itojun <itojun@NetBSD.org> | 2000-10-10 09:45:50 +0000 |
|---|---|---|
| committer | itojun <itojun@NetBSD.org> | 2000-10-10 09:45:50 +0000 |
| commit | a6ede27799fb1420b19c8a016cfbb2ceaaddc2d9 (patch) | |
| tree | c5db93b11d3a67f8edf9682bf43cf6bb2e02fb5d /gnu/dist | |
| parent | d72739fb8a1c8d419eaf5a7eea555fa4552a339e (diff) | |
(unexploitable) integer range check mistake in "sendmail -bt".
http://www.securityfocus.com/templates/archive.pike?threads=1&start=2000-10-08&mid=138539&fromthread=1&list=1&end=2000-10-14&
Diffstat (limited to 'gnu/dist')
| -rw-r--r-- | gnu/dist/sendmail/sendmail/macro.c | 9 | ||||
| -rw-r--r-- | gnu/dist/sendmail/sendmail/readcf.c | 2 | ||||
| -rw-r--r-- | gnu/dist/sendmail/sendmail/stab.c | 1 |
3 files changed, 9 insertions, 3 deletions
diff --git a/gnu/dist/sendmail/sendmail/macro.c b/gnu/dist/sendmail/sendmail/macro.c index ba346563c83..723cd9fd023 100644 --- a/gnu/dist/sendmail/sendmail/macro.c +++ b/gnu/dist/sendmail/sendmail/macro.c @@ -377,7 +377,7 @@ macid(p, ep) *ep = p + 1; if (tTd(35, 14)) dprintf("%c\n", *p); - return *p; + return ((unsigned int)*p) & 0xff; } bp = mbuf; while (*++p != '\0' && *p != '}' && bp < &mbuf[sizeof mbuf - 1]) @@ -401,7 +401,7 @@ macid(p, ep) else if (mbuf[1] == '\0') { /* ${x} == $x */ - mid = mbuf[0]; + mid = ((unsigned int)mbuf[0]) & 0xff; p++; } else @@ -428,6 +428,11 @@ macid(p, ep) } if (ep != NULL) *ep = p; + if (mid < 0 || mid > MAXMACROID) + { + syserr("Unable to assign macro/class ID (mid = 0x%x)", mid); + mid = 0; + } if (tTd(35, 14)) dprintf("0x%x\n", mid); return mid; diff --git a/gnu/dist/sendmail/sendmail/readcf.c b/gnu/dist/sendmail/sendmail/readcf.c index fbc3df2126a..c632c068893 100644 --- a/gnu/dist/sendmail/sendmail/readcf.c +++ b/gnu/dist/sendmail/sendmail/readcf.c @@ -3007,7 +3007,7 @@ setclass(class, str) dprintf("setclass(%s, %s)\n", macname(class), str); s = stab(str, ST_CLASS, ST_ENTER); - setbitn(class, s->s_class); + setbitn(((unsigned int)class) & 0xff, s->s_class); } } /* diff --git a/gnu/dist/sendmail/sendmail/stab.c b/gnu/dist/sendmail/sendmail/stab.c index 3bb9382fb55..aa1e8a81a95 100644 --- a/gnu/dist/sendmail/sendmail/stab.c +++ b/gnu/dist/sendmail/sendmail/stab.c @@ -326,6 +326,7 @@ copy_class(src, dst) register STAB **shead; register STAB *s; + dst = ((unsigned int)dst) & 0xff; for (shead = SymTab; shead < &SymTab[STABSIZE]; shead++) { for (s = *shead; s != NULL; s = s->s_next) |
