Replied: Mon, 09 Apr 2001 17:10:21 -0400
Replied: "Nickolai Zeldovich <kolya@MIT.EDU> source-reviewers@MIT.EDU"
Return-Path: <kolya@MIT.EDU>
Received: from central-city-carrier-station.mit.edu (CENTRAL-CITY-CARRIER-STATION.MIT.EDU [18.7.21.75]) 
	by tla.mit.edu (8.9.3) for <jweiss@TLA.LOCAL> with ESMTP
	id RAA08539; Sat, 7 Apr 2001 17:19:04 -0400 (EDT)
Received: from melbourne-city-street.mit.edu (MELBOURNE-CITY-STREET.MIT.EDU [18.7.21.86])
	by central-city-carrier-station.mit.edu (8.9.2/8.9.2) with ESMTP id RAA18494
	for <source-reviewers@MIT.EDU>; Sat, 7 Apr 2001 17:19:06 -0400 (EDT)
Received: from alice-whacker.mit.edu (ALICE-WHACKER.MIT.EDU [18.187.1.68])
	by melbourne-city-street.mit.edu (8.9.2/8.9.2) with ESMTP id RAA03768
	for <source-reviewers@MIT.EDU>; Sat, 7 Apr 2001 17:18:59 -0400 (EDT)
Received: (from kolya@localhost) by alice-whacker.mit.edu (8.9.3)
	id RAA23857; Sat, 7 Apr 2001 17:19:03 -0400
Message-Id: <200104072119.RAA23857@alice-whacker.mit.edu>
To: source-reviewers@MIT.EDU
Subject: xntp3 buffer overflow patch
Date: Sat, 07 Apr 2001 17:19:03 -0400
From: Nickolai Zeldovich <kolya@MIT.EDU>

This patch fixes a buffer overflow in xntpd.

I'd appreciate it if someone could check this in for me, modulo approval.

-- kolya

Index: ntp_control.c
===================================================================
RCS file: /afs/dev.mit.edu/source/repository/third/xntp/xntpd/ntp_control.c,v
retrieving revision 1.1.1.1
diff -u -r1.1.1.1 ntp_control.c
--- ntp_control.c	1997/12/02 20:28:16	1.1.1.1
+++ ntp_control.c	2001/04/07 21:05:42
@@ -1743,11 +1743,14 @@
 					return v;
 				}
 				if (*cp == '=') {
+					int cnt = sizeof(buf);
+
 					cp++;
 					tp = buf;
 					while (cp < reqend && isspace(*cp))
 						cp++;
-					while (cp < reqend && *cp != ',')
+					while (cp < reqend && *cp != ',' &&
+					       --cnt > 0)
 						*tp++ = *cp++;
 					if (cp < reqend)
 						cp++;