summaryrefslogtreecommitdiff
path: root/gnu/dist
diff options
context:
space:
mode:
authoritojun <itojun@NetBSD.org>2000-10-10 09:45:50 +0000
committeritojun <itojun@NetBSD.org>2000-10-10 09:45:50 +0000
commita6ede27799fb1420b19c8a016cfbb2ceaaddc2d9 (patch)
treec5db93b11d3a67f8edf9682bf43cf6bb2e02fb5d /gnu/dist
parentd72739fb8a1c8d419eaf5a7eea555fa4552a339e (diff)
(unexploitable) integer range check mistake in "sendmail -bt".
http://www.securityfocus.com/templates/archive.pike?threads=1&start=2000-10-08&mid=138539&fromthread=1&list=1&end=2000-10-14&
Diffstat (limited to 'gnu/dist')
-rw-r--r--gnu/dist/sendmail/sendmail/macro.c9
-rw-r--r--gnu/dist/sendmail/sendmail/readcf.c2
-rw-r--r--gnu/dist/sendmail/sendmail/stab.c1
3 files changed, 9 insertions, 3 deletions
diff --git a/gnu/dist/sendmail/sendmail/macro.c b/gnu/dist/sendmail/sendmail/macro.c
index ba346563c83..723cd9fd023 100644
--- a/gnu/dist/sendmail/sendmail/macro.c
+++ b/gnu/dist/sendmail/sendmail/macro.c
@@ -377,7 +377,7 @@ macid(p, ep)
*ep = p + 1;
if (tTd(35, 14))
dprintf("%c\n", *p);
- return *p;
+ return ((unsigned int)*p) & 0xff;
}
bp = mbuf;
while (*++p != '\0' && *p != '}' && bp < &mbuf[sizeof mbuf - 1])
@@ -401,7 +401,7 @@ macid(p, ep)
else if (mbuf[1] == '\0')
{
/* ${x} == $x */
- mid = mbuf[0];
+ mid = ((unsigned int)mbuf[0]) & 0xff;
p++;
}
else
@@ -428,6 +428,11 @@ macid(p, ep)
}
if (ep != NULL)
*ep = p;
+ if (mid < 0 || mid > MAXMACROID)
+ {
+ syserr("Unable to assign macro/class ID (mid = 0x%x)", mid);
+ mid = 0;
+ }
if (tTd(35, 14))
dprintf("0x%x\n", mid);
return mid;
diff --git a/gnu/dist/sendmail/sendmail/readcf.c b/gnu/dist/sendmail/sendmail/readcf.c
index fbc3df2126a..c632c068893 100644
--- a/gnu/dist/sendmail/sendmail/readcf.c
+++ b/gnu/dist/sendmail/sendmail/readcf.c
@@ -3007,7 +3007,7 @@ setclass(class, str)
dprintf("setclass(%s, %s)\n", macname(class), str);
s = stab(str, ST_CLASS, ST_ENTER);
- setbitn(class, s->s_class);
+ setbitn(((unsigned int)class) & 0xff, s->s_class);
}
}
/*
diff --git a/gnu/dist/sendmail/sendmail/stab.c b/gnu/dist/sendmail/sendmail/stab.c
index 3bb9382fb55..aa1e8a81a95 100644
--- a/gnu/dist/sendmail/sendmail/stab.c
+++ b/gnu/dist/sendmail/sendmail/stab.c
@@ -326,6 +326,7 @@ copy_class(src, dst)
register STAB **shead;
register STAB *s;
+ dst = ((unsigned int)dst) & 0xff;
for (shead = SymTab; shead < &SymTab[STABSIZE]; shead++)
{
for (s = *shead; s != NULL; s = s->s_next)