Subject: More oddities in beta-11 release

From: Anders Thulin <[email-masked]>
Date: Wed, 15 Jan 1997 09:39:27 +0100 (MET)

Here's some other weirdness in the beta left over from the old 2.4 release.
I have just noted the problems, not tried to fix them, so I don't have any
patch files.

---------

  ftpd.c:line 1713: char line[BUFSIZ];

  ftpd.c:line 1715: (void) sprintf(line, cmd, name), name = line;

  name is a parameter to retrieve(), line an automatic variable in
an inner block, whose address thus is passed out of that block, and
used later.

  This appears to be dangerous. I see no reason to assume this
works, except by good fortune.

  Making line static appears to fix the basic problem.

---------

I saw this mentioned in the one of the comp.security.* groups some time ago.

  popen.c:line 75, 76:    char **pop,
                               *argv[100],

and line 122:    for (argc = 0, cp = program;; cp = NULL)
                   if (!(argv[argc++] = strtok(cp, " \t\n")))
                     break;

  If ftpd_open ever is called with more than 100 arguments (which appears to
be up to the user) we risk a core dump, with all the associated unpleasantness.
 
  Adding a check that argc never reaches 100, and returns NULL (?) if it does
seems to be the best solution.

Anders Thulin      [email-masked]       013-23 55 32
Telia Engineering AB, Teknikringen 2B, S-583 30 Linkoping, Sweden

---

From: [email-masked] (Stan Barber)
Date: Thu, 16 Jan 1997 03:59:32 CST

These are both addressed in the upcoming beta-12 release.

-- 
Stan   | Academ Consulting Services        |internet: [email-masked]
Olan   | For more info on academ, see this |uucp: {mcsun|amdahl}!academ!sob
Barber | URL- http://www.academ.com/academ |Opinions expressed are only mine.