Skip site navigation (1)Skip section navigation (2) 
Date:      Tue, 6 Dec 2016 18:52:02 +0000 (UTC)
From:      Gleb Smirnoff <glebius@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r309641 - stable/11/contrib/telnet/telnetd
Message-ID:  <201612061852.uB6Iq2jd018147@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: glebius
Date: Tue Dec  6 18:52:02 2016
New Revision: 309641
URL: https://svnweb.freebsd.org/changeset/base/309641

Log:
  Merge r309638 from head:
  
    When telnetd(8) composes argument list for login(1), an unexpected sequence
    of memory allocation failures combined with insufficient error checking
    could result in the construction and execution of an argument sequence that
    was not intended.
  
    Fix that treating malloc(3) failures as fatal condition.
  
  Submitted by:	brooks
  Security:	FreeBSD-SA-16:36.telnetd

Modified:
  stable/11/contrib/telnet/telnetd/sys_term.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/contrib/telnet/telnetd/sys_term.c
==============================================================================
--- stable/11/contrib/telnet/telnetd/sys_term.c	Tue Dec  6 18:50:44 2016	(r309640)
+++ stable/11/contrib/telnet/telnetd/sys_term.c	Tue Dec  6 18:52:02 2016	(r309641)
@@ -1159,7 +1159,7 @@ addarg(char **argv, const char *val)
 		 */
 		argv = (char **)malloc(sizeof(*argv) * 12);
 		if (argv == NULL)
-			return(NULL);
+			fatal(net, "failure allocating argument space");
 		*argv++ = (char *)10;
 		*argv = (char *)0;
 	}
@@ -1170,11 +1170,12 @@ addarg(char **argv, const char *val)
 		*argv = (char *)((long)(*argv) + 10);
 		argv = (char **)realloc(argv, sizeof(*argv)*((long)(*argv) + 2));
 		if (argv == NULL)
-			return(NULL);
+			fatal(net, "failure allocating argument space");
 		argv++;
 		cpp = &argv[(long)argv[-1] - 10];
 	}
-	*cpp++ = strdup(val);
+	if ((*cpp++ = strdup(val)) == NULL)
+		fatal(net, "failure allocating argument space");
 	*cpp = 0;
 	return(argv);
 }

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201612061852.uB6Iq2jd018147>