MFS 1.10.2.5: Unbreak read/write behavior (introduced in previous revision).

procfs_fpregs.c 1.11.2.4, procfs_regs.c 1.10.2.4,
    procfs_rlimit.c 1.5.2.1, procfs_status.c 1.20.2.5, uio.h 1.11.2.2,
    linprocfs_misc.c 1.3.2.9.
Correct several integer underflows/overflows in procfs and linprocfs.

Makefile.inc1

@@ -489,7 +489,7 @@ update:
 	@echo "--------------------------------------------------------------"
 	@echo ">>> Updating ${.CURDIR} from cvs repository" ${CVSROOT}
 	@echo "--------------------------------------------------------------"
-	cd ${.CURDIR}; cvs -q update -rRELENG_4 -P -d
+	cd ${.CURDIR}; cvs -q update -rRELENG_4_3 -P -d
 .endif
 
 #

UPDATING

@@ -6,6 +6,162 @@ chronology since 4.0 was released is included, followed by the common
 items quick how-tos, followed by entries for versions of -current
 prior to 4.0 Release.
 
+This is for the 4.3 release branch.  All entries since 4.3 are an
+itemized list of commits to this branch, numbered from the beginning.
+By this count, we're at 4.3.0p28.
+
+The security advisories related to various patches contain information
+on how to build/install a minimal set of binaries and start/stop a
+minimal number of processes, if possible, for that patch.  For those
+updates that don't have an advisory, or to be safe, you can do a full
+build and install as described in the COMMON ITEMS section.
+
+20031003:	p42	FreeBSD-SA-03:17.procfs
+	Correct integer underflows/overflows in procfs(5) and linprocfs(5).
+
+20031002:	p41	FreeBSD-SA-03:16.filedesc
+	Correct a reference counting bug in readv(2).
+
+20030924:	p40	FreeBSD-SA-03:14.arp
+	Updated fix for arplookup bug.
+
+20030923:	p39	FreeBSD-SA-03:14.arp
+	Fix a bug in arplookup(), whereby a hostile party on a locally
+	attached network could exhaust kernel memory, and cause a system
+	panic, by sending a flood of spoofed ARP requests.
+
+20030917:	p38	FreeBSD-SA-03:13.sendmail
+	Fix another address parsing buffer overflow.
+
+20030916:	p37	FreeBSD-SA-03:12.openssh
+	Follow-up fixes for OpenSSH oversized packet buffer handling.
+
+20030916:	p36	FreeBSD-SA-03:12.openssh
+	OpenSSH oversized packet buffer handling corrected.
+
+20030810:	p35	FreeBSD-SA-03:10.iBCS2
+	iBCS2 system call translator for statfs leaked information.
+
+20030810:	p34	FreeBSD-SA-03:09.signal
+	Repair range-checking errors in signal handling.
+
+20030804:	p33	FreeBSD-SA-03:08.realpath
+	Correct a single byte buffer overflow in realpath(3).
+
+20030329:	p32	FreeBSD-SA-03:07.sendmail
+	sendmail address parsing buffer overflow.
+
+20030303:	p31	FreeBSD-SA-03:04.sendmail
+	sendmail header parsing buffer overflow, ident parsing bug.
+
+20021026:	p30
+	smrsh bypass bug.
+
+20020710:	p29	FreeBSD-SA-02:28.resolv
+	resolver buffer overflow.
+
+20020307:	p28	FreeBSD-SA-02:13.openssh
+	OpenSSH off-by-one error.
+
+20020223:	p27	FreeBSD-SA-02:18.zlib
+	zlib inflate error handling.
+
+20020127:	p26
+	sdiff temp file handling.
+
+20020127:	p25
+	gzip tempfile handling.
+
+20020123:	p24	FreeBSD-SA-02:08.exec.asc
+	There's a small window in exec where one could debug a setuid
+	program and obtain elevated priviledges.  This was corrected.
+
+20020123:	p23	FreeBSD-SA-02:07.k5su
+	k5su fixes.
+
+20011221:	p22	FreeBSD-SA-02:02:pw
+	A bug was fixed wherein the pw(8) command created a short-lived
+	but world-readable copy of /etc/master.passwd.
+
+20011202:	p21	FreeBSD-SA-01:63:openssh
+	A security hole in OpenSSH involving `UseLogin yes' has been
+	patched.
+
+20010920:	p20
+	Plug login.conf hole.
+
+20010911:	p19
+	semop fixes to prevent overflows.
+
+20010910:	p18	FreeBSD-SA-01:62.uucp
+	UUCP fixes.
+
+20010904:	p17	FreeBSD-SA-01:59.rmuser
+	Minor fix to p16.
+
+20010904:	p16	FreeBSD-SA-01:59.rmuser
+	Close race condition when updating /etc/master.passwd in rmuser.
+
+20010830:	p15	FreeBSD-SA-01:58.lpd
+	Fix lpd remote root exploitable buffer overflow.
+
+20010822:	p14	FreeBSD-SA-01:57.sendmail
+	Fix command line argument overflow problem in sendmail.
+
+20010821:	p13
+	Close the "IRC DCC" security problem.
+
+20010813:	p12	FreeBSD-SA-01:55.procfs
+	procfs permission tightening.
+
+20010810:	p11
+	Check filehandle size when mounting nfs filesystems.
+
+20010805:	p10	FreeBSD-SA-01:52.fragment
+	Prevent DoS attack from bogus fragmented packets.
+
+20010723:	p9	FreeBSD-SA-01:49.telnetd (part 2)
+	Fix a different overflow with output_data and netflush in
+	telnetd.  Make sure that you have both this update and the
+	previous one.
+
+20010721:	p8	FreeBSD-SA-01:49.telnetd (part 1)
+	Fix buffer overflow in telnetd.
+
+20010719:	p7	FreeBSD-SA-01:51.openssl
+	Add PRNG security patch from openssl to prevent guessing of
+	internal state.
+
+20010717:	p6	FreeBSD-SA-01:53.ipfw
+	Fix ipfw "me" definition.
+
+20010710:	p5	FreeBSD-SA-01:42.signal
+	Don't share signal handlers from rfork after exec.
+
+20010708:	p4	FreeBSD-SA-01:48.tcpdump
+	Fix possible tcpdump buffer overflow.
+
+20010704:	p3	FreeBSD-SA-01:56.tcp_wrappers
+	Unbreak paranoid host checking in tcp_wrappers.
+
+20010601:	p2	FreeBSD-SA-01:40.fts (part 2)
+	Fix a second instance of chdir with fts_safe_changedir().
+
+20010530:	p1	FreeBSD-SA-01:40.fts (part 1)
+	Fix to stat after chdir .. in fts to make sure we wind up where
+	we think we should.
+
+20010521:
+	Minor repo damange has happened.  This may cause problems
+	with cvsup of ports.  If you get errors, please see
+	http://www.FreeBSD.org/cgi/query-pr.cgi?pr=27495
+	at the bottom for details on a workaround.  The error message
+	is
+Updater failed: Cannot delete "/usr/ports/www/jakarta-tomcat/files": Directory not empty
+
+20010421:
+	FreeBSD 4.3 RELEASE
+
 20010202:
 	The KERNEL variable for buildkernel and installkernel has been
 	deprecated in favor of KERNCONF.  make kernel now combines these

contrib/diff/sdiff.c

@@ -19,6 +19,11 @@ the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.  */
 
 /* GNU SDIFF was written by Thomas Lord. */
 
+#ifndef lint
+static const char rcsid[] = 
+"$FreeBSD$";
+#endif /* not lint */
+
 #include "system.h"
 #include <stdio.h>
 #include <signal.h>
@@ -82,19 +87,6 @@ static void try_help PARAMS((char const *));
 static void untrapsig PARAMS((int));
 static void usage PARAMS((void));
 
-/* this lossage until the gnu libc conquers the universe */
-#if HAVE_TMPNAM
-#define private_tempnam() tmpnam ((char *) 0)
-#else
-#ifndef PVT_tmpdir
-#define PVT_tmpdir "/tmp"
-#endif
-#ifndef TMPDIR_ENV
-#define TMPDIR_ENV "TMPDIR"
-#endif
-static char *private_tempnam PARAMS((void));
-static int exists PARAMS((char const *));
-#endif
 static int diraccess PARAMS((char const *));
 
 /* Options: */
@@ -935,13 +927,29 @@ edit (left, lenl, right, lenr, outfile)
 	case 'q':
 	  return 0;
 	case 'e':
-	  if (! tmpname && ! (tmpname = private_tempnam ()))
-	    perror_fatal ("temporary file name");
-
-	  tmpmade = 1;
-
 	  {
-	    FILE *tmp = ck_fopen (tmpname, "w+");
+	    int tfd;
+	    FILE *tmp;
+
+	    if (tmpmade)
+	      {
+	        unlink (tmpname);
+	        tmpmade = 0;
+		free (tmpname);
+	      }
+
+	    asprintf (&tmpname, "%s/sdiff.XXXXXX",
+	      getenv("TMPDIR") ?: P_tmpdir);
+	    if (tmpname == NULL)
+	      perror_fatal ("temporary file name");
+	    tfd = mkstemp(tmpname);
+	    if (tfd == -1)
+	      perror_fatal ("temporary file name");
+	    tmp = fdopen (tfd, "w+");
+	    if (tmp == NULL)
+	      perror_fatal ("temporary file name");
+ 
+	    tmpmade = 1;
 
 	    if (cmd1 == 'l' || cmd1 == 'b')
 	      lf_copy (left, lenl, tmp);
@@ -1101,80 +1109,3 @@ diraccess (dir)
   struct stat buf;
   return stat (dir, &buf) == 0 && S_ISDIR (buf.st_mode);
 }
-
-#if ! HAVE_TMPNAM
-
-/* Return zero if we know that FILE does not exist.  */
-static int
-exists (file)
-     char const *file;
-{
-  struct stat buf;
-  return stat (file, &buf) == 0 || errno != ENOENT;
-}
-
-/* These are the characters used in temporary filenames.  */
-static char const letters[] =
-  "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
-
-/* Generate a temporary filename and return it (in a newly allocated buffer).
-   Use the prefix "dif" as in tempnam.
-   This goes through a cyclic pattern of all possible
-   filenames consisting of five decimal digits of the current pid and three
-   of the characters in `letters'.  Each potential filename is
-   tested for an already-existing file of the same name, and no name of an
-   existing file will be returned.  When the cycle reaches its end
-   return 0.  */
-static char *
-private_tempnam ()
-{
-  char const *dir = getenv (TMPDIR_ENV);
-  static char const tmpdir[] = PVT_tmpdir;
-  size_t index;
-  char *buf;
-  pid_t pid = getpid ();
-  size_t dlen;
-
-  if (!dir)
-    dir = tmpdir;
-
-  dlen = strlen (dir);
-
-  /* Remove trailing slashes from the directory name.  */
-  while (dlen && dir[dlen - 1] == '/')
-    --dlen;
-
-  buf = xmalloc (dlen + 1 + 3 + 5 + 1 + 3 + 1);
-
-  sprintf (buf, "%.*s/.", (int) dlen, dir);
-  if (diraccess (buf))
-    {
-      for (index = 0;
-	   index < ((sizeof (letters) - 1) * (sizeof (letters) - 1)
-		    * (sizeof (letters) - 1));
-	   ++index)
-	{
-	  /* Construct a file name and see if it already exists.
-
-	     We use a single counter in INDEX to cycle each of three
-	     character positions through each of 62 possible letters.  */
-
-	  sprintf (buf, "%.*s/dif%.5lu.%c%c%c", (int) dlen, dir,
-		   (unsigned long) pid % 100000,
-		   letters[index % (sizeof (letters) - 1)],
-		   letters[(index / (sizeof (letters) - 1))
-			   % (sizeof (letters) - 1)],
-		   letters[index / ((sizeof (letters) - 1) *
-				     (sizeof (letters) - 1))]);
-
-	  if (!exists (buf))
-	    return buf;
-	}
-      errno = EEXIST;
-    }
-
-  /* Don't free buf; `free' might change errno.  We'll exit soon anyway.  */
-  return 0;
-}
-
-#endif /* ! HAVE_TMPNAM */

contrib/sendmail/smrsh/smrsh.c

@@ -59,6 +59,8 @@ static char id[] = "@(#)$Id: smrsh.c,v 8.31.4.8 2001/01/22 19:00:26 gshapiro Exp
 #include <unistd.h>
 #include <stdio.h>
 #include <sys/file.h>
+#include <sys/types.h>
+#include <sys/stat.h>
 #include <string.h>
 #include <ctype.h>
 #include <errno.h>
@@ -156,6 +158,7 @@ main(argc, argv)
 	char cmdbuf[1000];
 	char pathbuf[1000];
 	char specialbuf[32];
+	struct stat st;
 
 #ifndef DEBUG
 # ifndef LOG_MAIL
@@ -292,6 +295,36 @@ main(argc, argv)
 #ifdef DEBUG
 			printf("Trying %s\n", cmdbuf);
 #endif /* DEBUG */
+			if (stat(cmdbuf, &st) < 0)
+			{
+				/* can't stat it */
+				(void) fprintf(stderr, "%s: %s not available for sendmail programs (stat failed)\n",
+					       prg, cmd);
+				if (p != NULL)
+					*p = ' ';
+#ifndef DEBUG
+				syslog(LOG_CRIT, "uid %d: attempt to use %s (stat failed)",
+				       (int) getuid(), cmd);
+#endif /* ! DEBUG */
+				exit(EX_UNAVAILABLE);
+			}
+			if (!S_ISREG(st.st_mode)
+#ifdef S_ISLNK
+			    && !S_ISLNK(st.st_mode)
+#endif /* S_ISLNK */
+			   )
+			{
+				/* can't stat it */
+				(void) fprintf(stderr, "%s: %s not available for sendmail programs (not a file)\n",
+					       prg, cmd);
+				if (p != NULL)
+					*p = ' ';
+#ifndef DEBUG
+				syslog(LOG_CRIT, "uid %d: attempt to use %s (not a file)",
+				       (int) getuid(), cmd);
+#endif /* ! DEBUG */
+				exit(EX_UNAVAILABLE);
+			}
 			if (access(cmdbuf, X_OK) < 0)
 			{
 				/* oops....  crack attack possiblity */

contrib/sendmail/src/conf.c

@@ -320,6 +320,8 @@ setdefaults(e)
 	DontLockReadFiles = TRUE;
 	DoubleBounceAddr = "postmaster";
 	MaxHeadersLength = MAXHDRSLEN;
+	MaxMimeHeaderLength = MAXLINE;
+	MaxMimeFieldLength = MaxMimeHeaderLength / 2;
 	MaxForwardEntries = 0;
 #if SASL
 	AuthMechanisms = newstr(AUTH_MECHANISMS);

contrib/sendmail/src/daemon.c

@@ -2776,7 +2776,7 @@ getauthinfo(fd, may_be_forged)
 	if (i < 0 || p == &ibuf[0])
 		goto noident;
 
-	if (*--p == '\n' && *--p == '\r')
+	if (p >= &ibuf[2] && *--p == '\n' && *--p == '\r')
 		p--;
 	*++p = '\0';
 

contrib/sendmail/src/headers.c

@@ -650,7 +650,8 @@ eatheader(e, full)
 			if (buf[0] != '\0')
 			{
 				if (bitset(H_FROM, h->h_flags))
-					expand(crackaddr(buf), buf, sizeof buf, e);
+					expand(crackaddr(buf, e),
+					       buf, sizeof buf, e);
 				h->h_value = newstr(buf);
 				h->h_flags &= ~H_DEFAULT;
 			}
@@ -973,7 +974,11 @@ priencode(p)
 **	it and replaces it with "$g".  The parse is totally ad hoc
 **	and isn't even guaranteed to leave something syntactically
 **	identical to what it started with.  However, it does leave
-**	something semantically identical.
+**	something semantically identical if possible, else at least
+**	syntactically correct.
+**
+**	For example, it changes "Real Name <[email protected]> (Comment)"
+**	to "Real Name <$g> (Comment)".
 **
 **	This algorithm has been cleaned up to handle a wider range
 **	of cases -- notably quoted and backslash escaped strings.
@@ -982,6 +987,7 @@ priencode(p)
 **
 **	Parameters:
 **		addr -- the address to be cracked.
+**		e -- the current envelope.
 **
 **	Returns:
 **		a pointer to the new version.
@@ -994,28 +1000,50 @@ priencode(p)
 **		be copied if it is to be reused.
 */
 
+#define SM_HAVE_ROOM		((bp < buflim) && (buflim <= bufend))
+
+/*
+**  Append a character to bp if we have room.
+**  If not, punt and return $g.
+*/
+
+#define SM_APPEND_CHAR(c)					\
+	do							\
+	{							\
+		if (SM_HAVE_ROOM)				\
+			*bp++ = (c);				\
+		else						\
+			goto returng;				\
+	} while (0)
+
+#if MAXNAME < 10
+ERROR MAXNAME must be at least 10
+#endif /* MAXNAME < 10 */
+
 char *
-crackaddr(addr)
+crackaddr(addr, e)
 	register char *addr;
+	ENVELOPE *e;
 {
 	register char *p;
 	register char c;
-	int cmtlev;
-	int realcmtlev;
-	int anglelev, realanglelev;
-	int copylev;
-	int bracklev;
-	bool qmode;
-	bool realqmode;
-	bool skipping;
-	bool putgmac = FALSE;
-	bool quoteit = FALSE;
-	bool gotangle = FALSE;
-	bool gotcolon = FALSE;
+	int cmtlev;			/* comment level in input string */
+	int realcmtlev;			/* comment level in output string */
+	int anglelev;			/* angle level in input string */
+	int copylev;			/* 0 == in address, >0 copying */
+	int bracklev;			/* bracket level for IPv6 addr check */
+	bool addangle;			/* put closing angle in output */
+	bool qmode;			/* quoting in original string? */
+	bool realqmode;			/* quoting in output string? */
+	bool putgmac = FALSE;		/* already wrote $g */
+	bool quoteit = FALSE;		/* need to quote next character */
+	bool gotangle = FALSE;		/* found first '<' */
+	bool gotcolon = FALSE;		/* found a ':' */
 	register char *bp;
 	char *buflim;
 	char *bufhead;
 	char *addrhead;
+	char *bufend;
 	static char buf[MAXNAME + 1];
 
 	if (tTd(33, 1))
@@ -1030,25 +1058,22 @@ crackaddr(addr)
 	**  adjusted later if we find them.
 	*/
 
+	buflim = bufend = &buf[sizeof(buf) - 1];
 	bp = bufhead = buf;
-	buflim = &buf[sizeof buf - 7];
 	p = addrhead = addr;
-	copylev = anglelev = realanglelev = cmtlev = realcmtlev = 0;
+	copylev = anglelev = cmtlev = realcmtlev = 0;
 	bracklev = 0;
-	qmode = realqmode = FALSE;
+	qmode = realqmode = addangle = FALSE;
 
 	while ((c = *p++) != '\0')
 	{
 		/*
-		**  If the buffer is overful, go into a special "skipping"
-		**  mode that tries to keep legal syntax but doesn't actually
-		**  output things.
+		**  Try to keep legal syntax using spare buffer space
+		**  (maintained by buflim).
 		*/
 
-		skipping = bp >= buflim;
-
-		if (copylev > 0 && !skipping)
-			*bp++ = c;
+		if (copylev > 0)
+			SM_APPEND_CHAR(c);
 
 		/* check for backslash escapes */
 		if (c == '\\')
@@ -1063,8 +1088,8 @@ crackaddr(addr)
 				p--;
 				goto putg;
 			}
-			if (copylev > 0 && !skipping)
-				*bp++ = c;
+			if (copylev > 0)
+				SM_APPEND_CHAR(c);
 			goto putg;
 		}
 
@@ -1072,8 +1097,14 @@ crackaddr(addr)
 		if (c == '"' && cmtlev <= 0)
 		{
 			qmode = !qmode;
-			if (copylev > 0 && !skipping)
+			if (copylev > 0 && SM_HAVE_ROOM)
+			{
+				if (realqmode)
+					buflim--;
+				else
+					buflim++;
 				realqmode = !realqmode;
+			}
 			continue;
 		}
 		if (qmode)
@@ -1085,15 +1116,15 @@ crackaddr(addr)
 			cmtlev++;
 
 			/* allow space for closing paren */
-			if (!skipping)
+			if (SM_HAVE_ROOM)
 			{
 				buflim--;
 				realcmtlev++;
 				if (copylev++ <= 0)
 				{
 					if (bp != bufhead)
-						*bp++ = ' ';
-					*bp++ = c;
+						SM_APPEND_CHAR(' ');
+					SM_APPEND_CHAR(c);
 				}
 			}
 		}
@@ -1103,7 +1134,7 @@ crackaddr(addr)
 			{
 				cmtlev--;
 				copylev--;
-				if (!skipping)
+				if (SM_HAVE_ROOM)
 				{
 					realcmtlev--;
 					buflim++;
@@ -1114,7 +1145,7 @@ crackaddr(addr)
 		else if (c == ')')
 		{
 			/* syntax error: unmatched ) */
-			if (copylev > 0 && !skipping)
+			if (copylev > 0 && SM_HAVE_ROOM)
 				bp--;
 		}
 
@@ -1132,7 +1163,7 @@ crackaddr(addr)
 
 			/*
 			**  Check for DECnet phase IV ``::'' (host::user)
-			**  or **  DECnet phase V ``:.'' syntaxes.  The latter
+			**  or DECnet phase V ``:.'' syntaxes.  The latter
 			**  covers ``user@DEC:.tay.myhost'' and
 			**  ``DEC:.tay.myhost::user'' syntaxes (bletch).
 			*/
@@ -1141,10 +1172,10 @@ crackaddr(addr)
 			{
 				if (cmtlev <= 0 && !qmode)
 					quoteit = TRUE;
-				if (copylev > 0 && !skipping)
+				if (copylev > 0)
 				{
-					*bp++ = c;
-					*bp++ = *p;
+					SM_APPEND_CHAR(c);
+					SM_APPEND_CHAR(*p);
 				}
 				p++;
 				goto putg;
@@ -1155,41 +1186,43 @@ crackaddr(addr)
 			bp = bufhead;
 			if (quoteit)
 			{
-				*bp++ = '"';
+				SM_APPEND_CHAR('"');
 
 				/* back up over the ':' and any spaces */
 				--p;
-				while (isascii(*--p) && isspace(*p))
+				while (p > addr &&
+				       isascii(*--p) && isspace(*p))
 					continue;
 				p++;
 			}
 			for (q = addrhead; q < p; )
 			{
 				c = *q++;
-				if (bp < buflim)
+				if (quoteit && c == '"')
 				{
-					if (quoteit && c == '"')
-						*bp++ = '\\';
-					*bp++ = c;
+					SM_APPEND_CHAR('\\');
+					SM_APPEND_CHAR(c);
 				}
+				else
+					SM_APPEND_CHAR(c);
 			}
 			if (quoteit)
 			{
 				if (bp == &bufhead[1])
 					bp--;
 				else
-					*bp++ = '"';
+					SM_APPEND_CHAR('"');
 				while ((c = *p++) != ':')
-				{
-					if (bp < buflim)
-						*bp++ = c;
-				}
-				*bp++ = c;
+					SM_APPEND_CHAR(c);
+				SM_APPEND_CHAR(c);
 			}
 
 			/* any trailing white space is part of group: */
-			while (isascii(*p) && isspace(*p) && bp < buflim)
-				*bp++ = *p++;
+			while (isascii(*p) && isspace(*p))
+			{
+				SM_APPEND_CHAR(*p);
+				p++;
+			}
 			copylev = 0;
 			putgmac = quoteit = FALSE;
 			bufhead = bp;
@@ -1198,10 +1231,7 @@ crackaddr(addr)
 		}
 
 		if (c == ';' && copylev <= 0 && !ColonOkInAddr)
-		{
-			if (bp < buflim)
-				*bp++ = c;
-		}
+			SM_APPEND_CHAR(c);
 
 		/* check for characters that may have to be quoted */
 		if (strchr(MustQuoteChars, c) != NULL)
@@ -1229,42 +1259,45 @@ crackaddr(addr)
 
 			/* oops -- have to change our mind */
 			anglelev = 1;
-			if (!skipping)
-				realanglelev = 1;
+			if (SM_HAVE_ROOM)
+			{
+				if (!addangle)
+					buflim--;
+				addangle = TRUE;
+			}
 
 			bp = bufhead;
 			if (quoteit)
 			{
-				*bp++ = '"';
+				SM_APPEND_CHAR('"');
 
 				/* back up over the '<' and any spaces */
 				--p;
-				while (isascii(*--p) && isspace(*p))
+				while (p > addr &&
+				       isascii(*--p) && isspace(*p))
 					continue;
 				p++;
 			}
 			for (q = addrhead; q < p; )
 			{
 				c = *q++;
-				if (bp < buflim)
+				if (quoteit && c == '"')
 				{
-					if (quoteit && c == '"')
-						*bp++ = '\\';
-					*bp++ = c;
+					SM_APPEND_CHAR('\\');
+					SM_APPEND_CHAR(c);
 				}
+				else
+					SM_APPEND_CHAR(c);
 			}
 			if (quoteit)
 			{
 				if (bp == &buf[1])
 					bp--;
 				else
-					*bp++ = '"';
+					SM_APPEND_CHAR('"');
 				while ((c = *p++) != '<')
-				{
-					if (bp < buflim)
-						*bp++ = c;
-				}
-				*bp++ = c;
+					SM_APPEND_CHAR(c);
+				SM_APPEND_CHAR(c);
 			}
 			copylev = 0;
 			putgmac = quoteit = FALSE;
@@ -1276,13 +1309,14 @@ crackaddr(addr)
 			if (anglelev > 0)
 			{
 				anglelev--;
-				if (!skipping)
+				if (SM_HAVE_ROOM)
 				{
-					realanglelev--;
-					buflim++;
+					if (addangle)
+						buflim++;
+					addangle = FALSE;
 				}
 			}
-			else if (!skipping)
+			else if (SM_HAVE_ROOM)
 			{
 				/* syntax error: unmatched > */
 				if (copylev > 0)
@@ -1291,7 +1325,7 @@ crackaddr(addr)
 				continue;
 			}
 			if (copylev++ <= 0)
-				*bp++ = c;
+				SM_APPEND_CHAR(c);
 			continue;
 		}
 
@@ -1299,30 +1333,42 @@ crackaddr(addr)
 	putg:
 		if (copylev <= 0 && !putgmac)
 		{
-			if (bp > bufhead && bp[-1] == ')')
-				*bp++ = ' ';
-			*bp++ = MACROEXPAND;
-			*bp++ = 'g';
+			if (bp > buf && bp[-1] == ')')
+				SM_APPEND_CHAR(' ');
+			SM_APPEND_CHAR(MACROEXPAND);
+			SM_APPEND_CHAR('g');
 			putgmac = TRUE;
 		}
 	}
 
 	/* repair any syntactic damage */
-	if (realqmode)
+	if (realqmode && bp < bufend)
 		*bp++ = '"';
-	while (realcmtlev-- > 0)
+	while (realcmtlev-- > 0 && bp < bufend)
 		*bp++ = ')';
-	while (realanglelev-- > 0)
+	if (addangle && bp < bufend)
 		*bp++ = '>';
-	*bp++ = '\0';
+	*bp = '\0';
+	if (bp < bufend)
+		goto success;
 
+ returng:
+	/* String too long, punt */
+	buf[0] = '<';
+	buf[1] = MACROEXPAND;
+	buf[2]= 'g';
+	buf[3] = '>';
+	buf[4]= '\0';
+	sm_syslog(LOG_ALERT, e->e_id,
+		  "Dropped invalid comments from header address");
+
+ success:
 	if (tTd(33, 1))
 	{
 		dprintf("crackaddr=>`");
 		xputs(buf);
 		dprintf("'\n");
 	}
-
 	return buf;
 }
 /*

contrib/sendmail/src/main.c

@@ -3133,7 +3133,7 @@ testmodeline(line, e)
 				printf("Usage: /parse address\n");
 				return;
 			}
-			q = crackaddr(p);
+			q = crackaddr(p, e);
 			printf("Cracked address = ");
 			xputs(q);
 			printf("\nParsing %s %s address\n",

contrib/sendmail/src/parseaddr.c

@@ -446,7 +446,7 @@ u_char	TokTypeNoC[256] =
 };
 
 
-#define NOCHAR		-1	/* signal nothing in lookahead token */
+#define NOCHAR		(-1)	/* signal nothing in lookahead token */
 
 char **
 prescan(addr, delim, pvpbuf, pvpbsize, delimptr, toktab)
@@ -532,22 +532,31 @@ prescan(addr, delim, pvpbuf, pvpbsize, delimptr, toktab)
 				/* see if there is room */
 				if (q >= &pvpbuf[pvpbsize - 5])
 				{
+	addrtoolong:
 					usrerr("553 5.1.1 Address too long");
 					if (strlen(addr) > (SIZE_T) MAXNAME)
 						addr[MAXNAME] = '\0';
 	returnnull:
 					if (delimptr != NULL)
+					{
+						if (p > addr)
+							p--;
 						*delimptr = p;
+					}
 					CurEnv->e_to = saveto;
 					return NULL;
 				}
 
 				/* squirrel it away */
+#if !ALLOW_255
+				if ((char) c == (char) -1 && !tTd(82, 101))
+					c &= 0x7f;
+#endif /* !ALLOW_255 */
 				*q++ = c;
 			}
 
 			/* read a new input character */
-			c = *p++;
+			c = (*p++) & 0x00ff;
 			if (c == '\0')
 			{
 				/* diagnose and patch up bad syntax */
@@ -602,6 +611,9 @@ prescan(addr, delim, pvpbuf, pvpbsize, delimptr, toktab)
 				}
 				else if (c != '!' || state == QST)
 				{
+					/* see if there is room */
+					if (q >= &pvpbuf[pvpbsize - 5])
+						goto addrtoolong;
 					*q++ = '\\';
 					continue;
 				}
@@ -686,6 +698,9 @@ prescan(addr, delim, pvpbuf, pvpbsize, delimptr, toktab)
 		/* new token */
 		if (tok != q)
 		{
+			/* see if there is room */
+			if (q >= &pvpbuf[pvpbsize - 5])
+				goto addrtoolong;
 			*q++ = '\0';
 			if (tTd(22, 36))
 			{
@@ -2289,7 +2304,7 @@ remotename(name, m, flags, pstat, e)
 	if (bitset(RF_CANONICAL, flags) || bitnset(M_NOCOMMENT, m->m_flags))
 		fancy = "\201g";
 	else
-		fancy = crackaddr(name);
+		fancy = crackaddr(name, e);
 
 	/*
 	**  Turn the name into canonical form.

contrib/sendmail/src/sendmail.h

@@ -270,7 +270,7 @@ extern ADDRESS	NullAddress;	/* a null (template) address [main.c] */
 
 /* functions */
 extern void	cataddr __P((char **, char **, char *, int, int));
-extern char	*crackaddr __P((char *));
+extern char	*crackaddr __P((char *, ENVELOPE *));
 extern bool	emptyaddr __P((ADDRESS *));
 extern ADDRESS	*getctladdr __P((ADDRESS *));
 extern int	include __P((char *, bool, ADDRESS *, ADDRESS **, int, ENVELOPE *));

contrib/sendmail/src/trace.c

@@ -63,7 +63,7 @@ void
 tTflag(s)
 	register char *s;
 {
-	int first, last;
+	unsigned int first, last;
 	register unsigned int i;
 
 	if (*s == '\0')

contrib/sendmail/src/version.c

@@ -15,4 +15,4 @@
 static char id[] = "@(#)$Id: version.c,v 8.43.4.30 2001/02/27 19:22:31 gshapiro Exp $";
 #endif /* ! lint */
 
-char	Version[] = "8.11.3";
+char	Version[] = "8.11.3p3";

contrib/tcp_wrappers/socket.c

@@ -222,7 +222,7 @@ struct host_info *host;
 	hints.ai_family = sin->sa_family;
 	hints.ai_socktype = SOCK_STREAM;
 	hints.ai_flags = AI_PASSIVE | AI_CANONNAME | AI_NUMERICHOST;
-	if ((err = getaddrinfo(host->name, NULL, &hints, &res0) == 0)) {
+	if ((err = getaddrinfo(host->name, NULL, &hints, &res0)) == 0) {
 	    freeaddrinfo(res0);
 	    tcpd_warn("host name/name mismatch: "
 		      "reverse lookup results in non-FQDN %s",

contrib/tcpdump/print-rx.c

@@ -580,14 +580,16 @@ rx_cache_find(const struct rx_header *rxh, const struct ip *ip, int sport,
 			printf(" fid %d/%d/%d", (int) n1, (int) n2, (int) n3); \
 		}
 
-#define STROUT(MAX) { int i; \
+#define STROUT(MAX) { unsigned int i; \
 			TRUNC(sizeof(int32_t)); \
-			i = (int) ntohl(*((int *) bp)); \
+			i = ntohl(*((int *) bp)); \
+			if (i > MAX) \
+				goto trunc; \
 			bp += sizeof(int32_t); \
-			TRUNC(i); \
-			strncpy(s, bp, min(MAX, i)); \
-			s[i] = '\0'; \
-			printf(" \"%s\"", s); \
+			printf(" \""); \
+			if (fn_printn(bp, i, snapend)) \
+				goto trunc; \
+			printf("\""); \
 			bp += ((i + sizeof(int32_t) - 1) / sizeof(int32_t)) * sizeof(int32_t); \
 		}
 
@@ -672,7 +674,9 @@ rx_cache_find(const struct rx_header *rxh, const struct ip *ip, int sport,
 				bp += sizeof(int32_t); \
 			} \
 			s[MAX] = '\0'; \
-			printf(" \"%s\"", s); \
+			printf(" \""); \
+			fn_print(s, NULL); \
+			printf("\""); \
 		}
 
 /*
@@ -954,7 +958,9 @@ acl_print(u_char *s, int maxsize, u_char *end)
 		if (sscanf((char *) s, "%s %d\n%n", user, &acl, &n) != 2)
 			goto finish;
 		s += n;
-		printf(" +{%s ", user);
+		printf(" +{");
+		fn_print(user, NULL);
+		printf(" ");
 		ACLOUT(acl);
 		printf("}");
 		if (s > end)
@@ -965,7 +971,9 @@ acl_print(u_char *s, int maxsize, u_char *end)
 		if (sscanf((char *) s, "%s %d\n%n", user, &acl, &n) != 2)
 			goto finish;
 		s += n;
-		printf(" -{%s ", user);
+		printf(" -{");
+		fn_print(user, NULL);
+		printf(" ");
 		ACLOUT(acl);
 		printf("}");
 		if (s > end)

crypto/heimdal/appl/su/su.c

@@ -134,7 +134,11 @@ krb5_verify(struct passwd *login_info, struct passwd *su_info,
 #ifdef KRB5
     krb5_error_code ret;
     krb5_principal p;
+    char *login_name = NULL;
 	
+#if defined(HAVE_GETLOGIN) && !defined(POSIX_GETLOGIN)
+    login_name = getlogin();
+#endif
     ret = krb5_init_context (&context);
     if (ret) {
 #if 0
@@ -143,9 +147,11 @@ krb5_verify(struct passwd *login_info, struct passwd *su_info,
 	return 1;
     }
 	
+    if (login_name == NULL || strcmp (login_name, "root") == 0) 
+	login_name = login_info->pw_name;
     if (strcmp (su_info->pw_name, "root") == 0)
 	ret = krb5_make_principal(context, &p, NULL, 
-				  login_info->pw_name,
+				  login_name,
 				  kerberos_instance,
 				  NULL);
     else
@@ -264,7 +270,6 @@ main(int argc, char **argv)
     int i, optind = 0;
     char *su_user;
     struct passwd *su_info;
-    char *login_user = NULL;
     struct passwd *login_info;
 
     struct passwd *pwd;
@@ -305,10 +310,6 @@ main(int argc, char **argv)
     }
     su_info = make_info(pwd);
     
-#if defined(HAVE_GETLOGIN) && !defined(POSIX_GETLOGIN)
-    login_user = getlogin();
-#endif
-    if(login_user == NULL || (pwd = getpwnam(login_user)) == NULL)
 	pwd = getpwuid(getuid());
     if(pwd == NULL)
 	errx(1, "who are you?");

crypto/openssh/buffer.c

@@ -23,8 +23,11 @@ RCSID("$OpenBSD: buffer.c,v 1.8 2000/09/07 20:27:50 deraadt Exp $");
 void
 buffer_init(Buffer *buffer)
 {
-	buffer->alloc = 4096;
-	buffer->buf = xmalloc(buffer->alloc);
+	const u_int len = 4096;
+
+	buffer->alloc = 0;
+	buffer->buf = xmalloc(len);
+	buffer->alloc = len;
 	buffer->offset = 0;
 	buffer->end = 0;
 }
@@ -34,8 +37,10 @@ buffer_init(Buffer *buffer)
 void
 buffer_free(Buffer *buffer)
 {
-	memset(buffer->buf, 0, buffer->alloc);
-	xfree(buffer->buf);
+	if (buffer->alloc > 0) {
+		memset(buffer->buf, 0, buffer->alloc);
+		xfree(buffer->buf);
+	}
 }
 
 /*
@@ -69,6 +74,8 @@ buffer_append(Buffer *buffer, const char *data, unsigned int len)
 void
 buffer_append_space(Buffer *buffer, char **datap, unsigned int len)
 {
+	u_int	newlen;
+
 	/* If the buffer is empty, start using it from the beginning. */
 	if (buffer->offset == buffer->end) {
 		buffer->offset = 0;
@@ -93,8 +100,12 @@ restart:
 		goto restart;
 	}
 	/* Increase the size of the buffer and retry. */
-	buffer->alloc += len + 32768;
-	buffer->buf = xrealloc(buffer->buf, buffer->alloc);
+	newlen = buffer->alloc + len + 32768;
+	if (newlen > 0xa00000)
+		fatal("buffer_append_space: alloc %u not supported",
+		    newlen);
+	buffer->buf = xrealloc(buffer->buf, newlen);
+	buffer->alloc = newlen;
 	goto restart;
 }
 

crypto/openssh/channels.c

@@ -157,7 +157,7 @@ Channel *
 channel_lookup(int id)
 {
 	Channel *c;
-	if (id < 0 || id > channels_alloc) {
+	if (id < 0 || id >= channels_alloc) {
 		log("channel_lookup: %d: bad id", id);
 		return NULL;
 	}
@@ -251,9 +251,13 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 	if (found == -1) {
 		/* There are no free slots.  Take last+1 slot and expand the array.  */
 		found = channels_alloc;
+		if (channels_alloc > 10000)
+			fatal("channel_new: internal error: channels_alloc %d "
+			    "too big.", channels_alloc);
+		channels = xrealloc(channels,
+		    (channels_alloc + 10) * sizeof(Channel));
 		channels_alloc += 10;
 		debug2("channel: expanding %d", channels_alloc);
-		channels = xrealloc(channels, channels_alloc * sizeof(Channel));
 		for (i = found; i < channels_alloc; i++)
 			channels[i].type = SSH_CHANNEL_FREE;
 	}

crypto/openssh/deattack.c

@@ -100,12 +100,12 @@ detect_attack(unsigned char *buf, u_int32_t len, unsigned char *IV)
 
 	if (h == NULL) {
 		debug("Installing crc compensation attack detector.");
+		h = (u_int16_t *) xmalloc(l * HASH_ENTRYSIZE);
 		n = l;
-		h = (u_int16_t *) xmalloc(n * HASH_ENTRYSIZE);
 	} else {
 		if (l > n) {
+			h = (u_int16_t *) xrealloc(h, l * HASH_ENTRYSIZE);
 			n = l;
-			h = (u_int16_t *) xrealloc(h, n * HASH_ENTRYSIZE);
 		}
 	}
 

crypto/openssh/scp.c

@@ -1217,18 +1217,21 @@ addargs(char *fmt, ...)
 {
 	va_list ap;
 	char buf[1024];
+	int nalloc;
 
 	va_start(ap, fmt);
 	vsnprintf(buf, sizeof(buf), fmt, ap);
 	va_end(ap);
 
 	if (args.list == NULL) {
-		args.nalloc = 32;
+		nalloc = 32;
 		args.num = 0;
-		args.list = xmalloc(args.nalloc * sizeof(char *));
+		args.list = xmalloc(nalloc * sizeof(char *));
+		args.nalloc = nalloc;
 	} else if (args.num+2 >= args.nalloc) {
-		args.nalloc *= 2;
-		args.list = xrealloc(args.list, args.nalloc * sizeof(char *));
+		nalloc = args.nalloc * 2;
+		args.list = xrealloc(args.list, nalloc * sizeof(char *));
+		args.nalloc = nalloc;
 	}
 	args.list[args.num++] = xstrdup(buf);
 	args.list[args.num] = NULL;

crypto/openssh/session.c

@@ -848,6 +848,7 @@ void
 child_set_env(char ***envp, unsigned int *envsizep, const char *name,
 	      const char *value)
 {
+	u_int envsize;
 	unsigned int i, namelen;
 	char **env;
 
@@ -866,9 +867,11 @@ child_set_env(char ***envp, unsigned int *envsizep, const char *name,
 		xfree(env[i]);
 	} else {
 		/* New variable.  Expand if necessary. */
-		if (i >= (*envsizep) - 1) {
-			(*envsizep) += 50;
-			env = (*envp) = xrealloc(env, (*envsizep) * sizeof(char *));
+		envsize = *envsizep;
+		if (i >= envsize - 1) {
+			envsize += 50;
+			env = (*envp) = xrealloc(env, envsize * sizeof(char *));
+			*envsizep = envsize;
 		}
 		/* Need to set the NULL pointer at end of array beyond the new slot. */
 		env[i + 1] = NULL;
@@ -1118,6 +1121,7 @@ do_child(const char *command, struct passwd * pw, const char *term,
 		child_set_env(&env, &envsize, "TZ", getenv("TZ"));
 
 	/* Set custom environment options from RSA authentication. */
+	if (!options.use_login) {
 	while (custom_environment) {
 		struct envstring *ce = custom_environment;
 		char *s = ce->s;
@@ -1131,6 +1135,7 @@ do_child(const char *command, struct passwd * pw, const char *term,
 		xfree(ce->s);
 		xfree(ce);
 	}
+	}
 
 	snprintf(buf, sizeof buf, "%.50s %d %d",
 		 get_remote_ipaddr(), get_remote_port(), get_local_port());

crypto/openssh/ssh-agent.c

@@ -515,7 +515,7 @@ process_message(SocketEntry *e)
 void
 new_socket(int type, int fd)
 {
-	unsigned int i, old_alloc;
+	unsigned int i, old_alloc, new_alloc;
 	if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0)
 		error("fcntl O_NONBLOCK: %s", strerror(errno));
 
@@ -525,23 +525,24 @@ new_socket(int type, int fd)
 	for (i = 0; i < sockets_alloc; i++)
 		if (sockets[i].type == AUTH_UNUSED) {
 			sockets[i].fd = fd;
-			sockets[i].type = type;
 			buffer_init(&sockets[i].input);
 			buffer_init(&sockets[i].output);
+			sockets[i].type = type;
 			return;
 		}
 	old_alloc = sockets_alloc;
-	sockets_alloc += 10;
+	new_alloc = sockets_alloc + 10;
 	if (sockets)
-		sockets = xrealloc(sockets, sockets_alloc * sizeof(sockets[0]));
+		sockets = xrealloc(sockets, new_alloc * sizeof(sockets[0]));
 	else
-		sockets = xmalloc(sockets_alloc * sizeof(sockets[0]));
-	for (i = old_alloc; i < sockets_alloc; i++)
+		sockets = xmalloc(new_alloc * sizeof(sockets[0]));
+	for (i = old_alloc; i < new_alloc; i++)
 		sockets[i].type = AUTH_UNUSED;
-	sockets[old_alloc].type = type;
+	sockets_alloc = new_alloc;
 	sockets[old_alloc].fd = fd;
 	buffer_init(&sockets[old_alloc].input);
 	buffer_init(&sockets[old_alloc].output);
+	sockets[old_alloc].type = type;
 }
 
 void

crypto/openssh/version.h

@@ -1,4 +1,4 @@
 /* $FreeBSD$ */
 /* $OpenBSD: version.h,v 1.13 2000/10/16 09:38:45 djm Exp $ */
 
-#define SSH_VERSION	"OpenSSH_2.3.0 [email protected] 20010321"
+#define SSH_VERSION	"OpenSSH_2.3.0 [email protected] 20030917"

crypto/openssl/crypto/rand/md_rand.c

@@ -308,6 +308,7 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
 	{
 	static volatile int stirred_pool = 0;
 	int i,j,k,st_num,st_idx;
+	int num_ceil;
 	int ok;
 	long md_c[2];
 	unsigned char local_md[MD_DIGEST_LENGTH];
@@ -328,6 +329,12 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
 		}
 #endif
 
+	if (num <= 0)
+		return 1;
+	
+	/* round upwards to multiple of MD_DIGEST_LENGTH/2 */
+	num_ceil = (1 + (num-1)/(MD_DIGEST_LENGTH/2)) * (MD_DIGEST_LENGTH/2);
+
 	/*
 	 * (Based on the rand(3) manpage:)
 	 *
@@ -409,11 +416,11 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
 	md_c[1] = md_count[1];
 	memcpy(local_md, md, sizeof md);
 
-	state_index+=num;
+	state_index+=num_ceil;
 	if (state_index > state_num)
 		state_index %= state_num;
 
-	/* state[st_idx], ..., state[(st_idx + num - 1) % st_num]
+	/* state[st_idx], ..., state[(st_idx + num_ceil - 1) % st_num]
 	 * are now ours (but other threads may use them too) */
 
 	md_count[0] += 1;
@@ -424,6 +431,7 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
 
 	while (num > 0)
 		{
+		/* num_ceil -= MD_DIGEST_LENGTH/2 */
 		j=(num >= MD_DIGEST_LENGTH/2)?MD_DIGEST_LENGTH/2:num;
 		num-=j;
 		MD_Init(&m);
@@ -434,27 +442,28 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
 			curr_pid = 0;
 			}
 #endif
-		MD_Update(&m,&(local_md[MD_DIGEST_LENGTH/2]),MD_DIGEST_LENGTH/2);
+		MD_Update(&m,local_md,MD_DIGEST_LENGTH);
 		MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
 #ifndef PURIFY
 		MD_Update(&m,buf,j); /* purify complains */
 #endif
-		k=(st_idx+j)-st_num;
+		k=(st_idx+MD_DIGEST_LENGTH/2)-st_num;
 		if (k > 0)
 			{
-			MD_Update(&m,&(state[st_idx]),j-k);
+			MD_Update(&m,&(state[st_idx]),MD_DIGEST_LENGTH/2-k);
 			MD_Update(&m,&(state[0]),k);
 			}
 		else
-			MD_Update(&m,&(state[st_idx]),j);
+			MD_Update(&m,&(state[st_idx]),MD_DIGEST_LENGTH/2);
 		MD_Final(local_md,&m);
 
-		for (i=0; i<j; i++)
+		for (i=0; i<MD_DIGEST_LENGTH/2; i++)
 			{
 			state[st_idx++]^=local_md[i]; /* may compete with other threads */
-			*(buf++)=local_md[i+MD_DIGEST_LENGTH/2];
 			if (st_idx >= st_num)
 				st_idx=0;
+			if (i < j)
+				*(buf++)=local_md[i+MD_DIGEST_LENGTH/2];
 			}
 		}
 

crypto/telnet/telnetd/authenc.c

@@ -49,8 +49,7 @@ net_write(str, len)
 	int len;
 {
 	if (nfrontp + len < netobuf + BUFSIZ) {
-		memmove((void *)nfrontp, (void *)str, len);
-		nfrontp += len;
+		output_datalen(str, len);
 		return(len);
 	}
 	return(0);

crypto/telnet/telnetd/ext.h

@@ -74,7 +74,7 @@ extern char	ptyobuf[BUFSIZ+NETSLOP], *pfrontp, *pbackp;
 
 extern char	netibuf[BUFSIZ], *netip;
 
-extern char	netobuf[BUFSIZ+NETSLOP], *nfrontp, *nbackp;
+extern char	netobuf[BUFSIZ], *nfrontp, *nbackp;
 extern char	*neturg;		/* one past last bye of urgent data */
 
 extern int	pcc, ncc;
@@ -187,8 +187,10 @@ extern void
 	tty_setsofttab P((int)),
 	tty_tspeed P((int)),
 	willoption P((int)),
-	wontoption P((int)),
-	writenet P((unsigned char *, int));
+	wontoption P((int));
+
+int	output_data __P((const char *, ...)) __printflike(1, 2);
+void	output_datalen __P((const char *, int));
 
 #ifdef	ENCRYPTION
 extern void	(*encrypt_output) P((unsigned char *, int));

crypto/telnet/telnetd/slc.c

@@ -176,7 +176,6 @@ end_slc(bufp)
 	register unsigned char **bufp;
 {
 	register int len;
-	void netflush();
 
 	/*
 	 * If a change has occured, store the new terminal control
@@ -204,7 +203,7 @@ end_slc(bufp)
 			(void) sprintf((char *)slcptr, "%c%c", IAC, SE);
 			slcptr += 2;
 			len = slcptr - slcbuf;
-			writenet(slcbuf, len);
+			output_datalen(slcbuf, len);
 			netflush();  /* force it out immediately */
 			DIAG(TD_OPTIONS, printsub('>', slcbuf+2, len-2););
 		}

crypto/telnet/telnetd/state.c

@@ -39,6 +39,7 @@ static const char rcsid[] =
   "$FreeBSD$";
 #endif /* not lint */
 
+#include <stdarg.h>
 #include "telnetd.h"
 #if	defined(AUTHENTICATION)
 #include <libtelnet/auth.h>
@@ -205,8 +206,7 @@ gotiac:			switch (c) {
 				}
 
 				netclear();	/* clear buffer back */
-				*nfrontp++ = IAC;
-				*nfrontp++ = DM;
+				output_data("%c%c", IAC, DM);
 				neturg = nfrontp-1; /* off by one XXX */
 				DIAG(TD_OPTIONS,
 					printoption("td: send IAC", DM));
@@ -459,8 +459,7 @@ send_do(option, init)
 			set_his_want_state_will(option);
 		do_dont_resp[option]++;
 	}
-	(void) sprintf(nfrontp, (char *)doopt, option);
-	nfrontp += sizeof (dont) - 2;
+	output_data((const char *)doopt, option);
 
 	DIAG(TD_OPTIONS, printoption("td: send do", option));
 }
@@ -679,8 +678,7 @@ send_dont(option, init)
 		set_his_want_state_wont(option);
 		do_dont_resp[option]++;
 	}
-	(void) sprintf(nfrontp, (char *)dont, option);
-	nfrontp += sizeof (doopt) - 2;
+	output_data((const char *)dont, option);
 
 	DIAG(TD_OPTIONS, printoption("td: send dont", option));
 }
@@ -828,8 +826,7 @@ send_will(option, init)
 		set_my_want_state_will(option);
 		will_wont_resp[option]++;
 	}
-	(void) sprintf(nfrontp, (char *)will, option);
-	nfrontp += sizeof (doopt) - 2;
+	output_data((const char *)will, option);
 
 	DIAG(TD_OPTIONS, printoption("td: send will", option));
 }
@@ -987,8 +984,7 @@ send_wont(option, init)
 		set_my_want_state_wont(option);
 		will_wont_resp[option]++;
 	}
-	(void) sprintf(nfrontp, (char *)wont, option);
-	nfrontp += sizeof (wont) - 2;
+	output_data((const char *)wont, option);
 
 	DIAG(TD_OPTIONS, printoption("td: send wont", option));
 }
@@ -1384,9 +1380,8 @@ suboption()
 	    env_ovar_wrong:
 			env_ovar = OLD_ENV_VALUE;
 			env_ovalue = OLD_ENV_VAR;
-			DIAG(TD_OPTIONS, {sprintf(nfrontp,
-				"ENVIRON VALUE and VAR are reversed!\r\n");
-				nfrontp += strlen(nfrontp);});
+			DIAG(TD_OPTIONS,
+			    output_data("ENVIRON VALUE and VAR are reversed!\r\n"));
 
 		}
 	    }
@@ -1611,9 +1606,55 @@ send_status()
 	ADD(IAC);
 	ADD(SE);
 
-	writenet(statusbuf, ncp - statusbuf);
+	output_datalen(statusbuf, ncp - statusbuf);
 	netflush();	/* Send it on its way */
 
 	DIAG(TD_OPTIONS,
 		{printsub('>', statusbuf, ncp - statusbuf); netflush();});
 }
+
+/*
+ * This function appends data to nfrontp and advances nfrontp.
+ * Returns the number of characters written altogether (the
+ * buffer may have been flushed in the process).
+ */
+
+int
+output_data(const char *format, ...)
+{
+	va_list args;
+	int len;
+	char *buf;
+
+	va_start(args, format);
+	if ((len = vasprintf(&buf, format, args)) == -1)
+		return -1;
+	output_datalen(buf, len);
+	va_end(args);
+	free(buf);
+	return (len);
+}
+
+void
+output_datalen(const char *buf, int len)
+{
+	int remaining, copied;
+	
+	remaining = BUFSIZ - (nfrontp - netobuf);
+	while (len > 0) {
+		/* Free up enough space if the room is too low*/
+		if ((len > BUFSIZ ? BUFSIZ : len) > remaining) {
+			netflush();
+			remaining = BUFSIZ - (nfrontp - netobuf);
+		}
+
+		/* Copy out as much as will fit */
+		copied = remaining > len ? len : remaining;
+		memmove(nfrontp, buf, copied);
+		nfrontp += copied;
+		len -= copied;
+		remaining -= copied;
+		buf += copied;
+	}
+	return;
+}

crypto/telnet/telnetd/telnetd.c

@@ -683,38 +683,33 @@ getterminaltype(name)
 	static unsigned char sb[] =
 			{ IAC, SB, TELOPT_TSPEED, TELQUAL_SEND, IAC, SE };
 
-	memmove(nfrontp, sb, sizeof sb);
-	nfrontp += sizeof sb;
+	output_datalen(sb, sizeof sb);
 	DIAG(TD_OPTIONS, printsub('>', sb + 2, sizeof sb - 2););
     }
     if (his_state_is_will(TELOPT_XDISPLOC)) {
 	static unsigned char sb[] =
 			{ IAC, SB, TELOPT_XDISPLOC, TELQUAL_SEND, IAC, SE };
 
-	memmove(nfrontp, sb, sizeof sb);
-	nfrontp += sizeof sb;
+	output_datalen(sb, sizeof sb);
 	DIAG(TD_OPTIONS, printsub('>', sb + 2, sizeof sb - 2););
     }
     if (his_state_is_will(TELOPT_NEW_ENVIRON)) {
 	static unsigned char sb[] =
 			{ IAC, SB, TELOPT_NEW_ENVIRON, TELQUAL_SEND, IAC, SE };
 
-	memmove(nfrontp, sb, sizeof sb);
-	nfrontp += sizeof sb;
+	output_datalen(sb, sizeof sb);
 	DIAG(TD_OPTIONS, printsub('>', sb + 2, sizeof sb - 2););
     }
     else if (his_state_is_will(TELOPT_OLD_ENVIRON)) {
 	static unsigned char sb[] =
 			{ IAC, SB, TELOPT_OLD_ENVIRON, TELQUAL_SEND, IAC, SE };
 
-	memmove(nfrontp, sb, sizeof sb);
-	nfrontp += sizeof sb;
+	output_datalen(sb, sizeof sb);
 	DIAG(TD_OPTIONS, printsub('>', sb + 2, sizeof sb - 2););
     }
     if (his_state_is_will(TELOPT_TTYPE)) {
 
-	memmove(nfrontp, ttytype_sbbuf, sizeof ttytype_sbbuf);
-	nfrontp += sizeof ttytype_sbbuf;
+	output_datalen(ttytype_sbbuf, sizeof ttytype_sbbuf);
 	DIAG(TD_OPTIONS, printsub('>', ttytype_sbbuf + 2,
 					sizeof ttytype_sbbuf - 2););
     }
@@ -793,8 +788,7 @@ _gettermname()
     if (his_state_is_wont(TELOPT_TTYPE))
 	return;
     settimer(baseline);
-    memmove(nfrontp, ttytype_sbbuf, sizeof ttytype_sbbuf);
-    nfrontp += sizeof ttytype_sbbuf;
+    output_datalen(ttytype_sbbuf, sizeof ttytype_sbbuf);
     DIAG(TD_OPTIONS, printsub('>', ttytype_sbbuf + 2,
 					sizeof ttytype_sbbuf - 2););
     while (sequenceIs(ttypesubopt, baseline))
@@ -958,7 +952,6 @@ telnet(f, p, host)
 	char *HE;
 	char *HN;
 	char *IM;
-	void netflush();
 	int nfd;
 
 	/*
@@ -1044,9 +1037,7 @@ telnet(f, p, host)
 	 * mode, which we do not want.
 	 */
 	if (his_want_state_is_will(TELOPT_ECHO)) {
-		DIAG(TD_OPTIONS,
-			{sprintf(nfrontp, "td: simulating recv\r\n");
-			 nfrontp += strlen(nfrontp);});
+		DIAG(TD_OPTIONS, output_data("td: simulating recv\r\n"));
 		willoption(TELOPT_ECHO);
 	}
 
@@ -1181,9 +1172,7 @@ telnet(f, p, host)
 	localstat();
 #endif	/* LINEMODE */
 
-	DIAG(TD_REPORT,
-		{sprintf(nfrontp, "td: Entering processing loop\r\n");
-		 nfrontp += strlen(nfrontp);});
+	DIAG(TD_REPORT, output_data("td: Entering processing loop\r\n"));
 
 	/*
 	 * Startup the login process on the slave side of the terminal
@@ -1312,8 +1301,7 @@ telnet(f, p, host)
 			netip = netibuf;
 		    }
 		    DIAG((TD_REPORT | TD_NETDATA),
-			    {sprintf(nfrontp, "td: netread %d chars\r\n", ncc);
-			     nfrontp += strlen(nfrontp);});
+			output_data("td: netread %d chars\r\n", ncc));
 		    DIAG(TD_NETDATA, printdata("nd", netip, ncc));
 		}
 
@@ -1360,8 +1348,7 @@ telnet(f, p, host)
 					 * royally if we send them urgent
 					 * mode data.
 					 */
-					*nfrontp++ = IAC;
-					*nfrontp++ = DM;
+					output_data("%c%c", IAC, DM);
 					neturg = nfrontp-1; /* off by one XXX */
 					DIAG(TD_OPTIONS,
 					    printoption("td: send IAC", DM));
@@ -1375,13 +1362,11 @@ telnet(f, p, host)
 					    ptyibuf[0] & TIOCPKT_DOSTOP ? 1 : 0;
 					if (newflow != flowmode) {
 						flowmode = newflow;
-						(void) sprintf(nfrontp,
-							"%c%c%c%c%c%c",
+						output_data("%c%c%c%c%c%c",
 							IAC, SB, TELOPT_LFLOW,
 							flowmode ? LFLOW_ON
 								 : LFLOW_OFF,
 							IAC, SE);
-						nfrontp += 6;
 						DIAG(TD_OPTIONS, printsub('>',
 						    (unsigned char *)nfrontp-4,
 						    4););
@@ -1407,19 +1392,19 @@ telnet(f, p, host)
 				break;
 			c = *ptyip++ & 0377, pcc--;
 			if (c == IAC)
-				*nfrontp++ = c;
+				output_data("%c", c);
 #if	defined(CRAY2) && defined(UNICOS5)
 			else if (c == '\n' &&
 				     my_state_is_wont(TELOPT_BINARY) && newmap)
-				*nfrontp++ = '\r';
+				output_data("\r");
 #endif	/* defined(CRAY2) && defined(UNICOS5) */
-			*nfrontp++ = c;
+			output_data("%c", c);
 			if ((c == '\r') && (my_state_is_wont(TELOPT_BINARY))) {
 				if (pcc > 0 && ((*ptyip & 0377) == '\n')) {
-					*nfrontp++ = *ptyip++ & 0377;
+					output_data("%c", *ptyip++ & 0377);
 					pcc--;
 				} else
-					*nfrontp++ = '\0';
+					output_data("%c", '\0');
 			}
 		}
 #if	defined(CRAY2) && defined(UNICOS5)
@@ -1613,8 +1598,7 @@ recv_ayt()
 		return;
 	}
 #endif
-	(void) strcpy(nfrontp, "\r\n[Yes]\r\n");
-	nfrontp += 9;
+	output_data("\r\n[Yes]\r\n");
 }
 
 	void

crypto/telnet/telnetd/termstat.c

@@ -140,7 +140,6 @@ int	newmap = 1;	/* nonzero if \n maps to ^M^J */
 	void
 localstat()
 {
-	void netflush();
 	int need_will_echo = 0;
 
 #if	defined(CRAY2) && defined(UNICOS5)
@@ -302,10 +301,9 @@ localstat()
 # endif	/* KLUDGELINEMODE */
 			send_do(TELOPT_LINEMODE, 1);
 			/* send along edit modes */
-			(void) sprintf(nfrontp, "%c%c%c%c%c%c%c", IAC, SB,
+			output_data("%c%c%c%c%c%c%c", IAC, SB,
 				TELOPT_LINEMODE, LM_MODE, useeditmode,
 				IAC, SE);
-			nfrontp += 7;
 			editmode = useeditmode;
 # ifdef	KLUDGELINEMODE
 		}
@@ -331,10 +329,9 @@ localstat()
 			/*
 			 * Send along appropriate edit mode mask.
 			 */
-			(void) sprintf(nfrontp, "%c%c%c%c%c%c%c", IAC, SB,
+			output_data("%c%c%c%c%c%c%c", IAC, SB,
 				TELOPT_LINEMODE, LM_MODE, useeditmode,
 				IAC, SE);
-			nfrontp += 7;
 			editmode = useeditmode;
 		}
 
@@ -378,20 +375,18 @@ flowstat()
 	if (his_state_is_will(TELOPT_LFLOW)) {
 		if (tty_flowmode() != flowmode) {
 			flowmode = tty_flowmode();
-			(void) sprintf(nfrontp, "%c%c%c%c%c%c",
+			output_data("%c%c%c%c%c%c",
 					IAC, SB, TELOPT_LFLOW,
 					flowmode ? LFLOW_ON : LFLOW_OFF,
 					IAC, SE);
-			nfrontp += 6;
 		}
 		if (tty_restartany() != restartany) {
 			restartany = tty_restartany();
-			(void) sprintf(nfrontp, "%c%c%c%c%c%c",
+			output_data("%c%c%c%c%c%c",
 					IAC, SB, TELOPT_LFLOW,
 					restartany ? LFLOW_RESTART_ANY
 						   : LFLOW_RESTART_XON,
 					IAC, SE);
-			nfrontp += 6;
 		}
 	}
 }
@@ -408,7 +403,6 @@ flowstat()
 clientstat(code, parm1, parm2)
 	register int code, parm1, parm2;
 {
-	void netflush();
 
 	/*
 	 * Get a copy of terminal characteristics.
@@ -464,10 +458,9 @@ clientstat(code, parm1, parm2)
 					useeditmode |= MODE_SOFT_TAB;
 				if (tty_islitecho())
 					useeditmode |= MODE_LIT_ECHO;
-				(void) sprintf(nfrontp, "%c%c%c%c%c%c%c", IAC,
+				output_data("%c%c%c%c%c%c%c", IAC,
 					SB, TELOPT_LINEMODE, LM_MODE,
 							useeditmode, IAC, SE);
-				nfrontp += 7;
 				editmode = useeditmode;
 			}
 
@@ -523,11 +516,10 @@ clientstat(code, parm1, parm2)
 			set_termbuf();
 
  			if (!ack) {
- 				(void) sprintf(nfrontp, "%c%c%c%c%c%c%c", IAC,
+				output_data("%c%c%c%c%c%c%c", IAC,
 					SB, TELOPT_LINEMODE, LM_MODE,
  					useeditmode|MODE_ACK,
  					IAC, SE);
- 				nfrontp += 7;
  			}
 
 			editmode = useeditmode;

crypto/telnet/telnetd/utility.c

@@ -69,11 +69,9 @@ static const char rcsid[] =
     void
 ttloop()
 {
-    void netflush();
 
-    DIAG(TD_REPORT, {sprintf(nfrontp, "td: ttloop\r\n");
-		     nfrontp += strlen(nfrontp);});
-    if (nfrontp-nbackp) {
+    DIAG(TD_REPORT, output_data("td: ttloop\r\n"));
+    if (nfrontp - nbackp > 0) {
 	netflush();
     }
     ncc = read(net, netibuf, sizeof netibuf);
@@ -84,8 +82,7 @@ ttloop()
 	syslog(LOG_INFO, "ttloop:  peer died: %m");
 	exit(1);
     }
-    DIAG(TD_REPORT, {sprintf(nfrontp, "td: ttloop read %d chars\r\n", ncc);
-		     nfrontp += strlen(nfrontp);});
+    DIAG(TD_REPORT, output_data("td: ttloop read %d chars\r\n", ncc));
     netip = netibuf;
     telrcv();			/* state machine */
     if (ncc > 0) {
@@ -128,9 +125,8 @@ ptyflush()
 	int n;
 
 	if ((n = pfrontp - pbackp) > 0) {
-		DIAG((TD_REPORT | TD_PTYDATA),
-			{ sprintf(nfrontp, "td: ptyflush %d chars\r\n", n);
-			  nfrontp += strlen(nfrontp); });
+		DIAG(TD_REPORT | TD_PTYDATA,
+		    output_data("td: ptyflush %d chars\r\n", n));
 		DIAG(TD_PTYDATA, printdata("pd", pbackp, n));
 		n = write(pty, pbackp, n);
 	}
@@ -260,12 +256,13 @@ netflush()
     int n;
     extern int not42;
 
-    if ((n = nfrontp - nbackp) > 0) {
-	DIAG(TD_REPORT,
-	    { sprintf(nfrontp, "td: netflush %d chars\r\n", n);
-	      n += strlen(nfrontp);  /* get count first */
-	      nfrontp += strlen(nfrontp);  /* then move pointer */
-	    });
+    while ((n = nfrontp - nbackp) > 0) {
+#if 0
+	/* XXX This causes output_data() to recurse and die */
+	DIAG(TD_REPORT, {
+	    n += output_data("td: netflush %d chars\r\n", n);
+	});
+#endif
 #ifdef	ENCRYPTION
 	if (encrypt_output) {
 		char *s = nclearto ? nclearto : nbackp;
@@ -298,57 +295,31 @@ netflush()
 		n = send(net, nbackp, n, MSG_OOB);	/* URGENT data */
 	    }
 	}
-    }
-    if (n < 0) {
-	if (errno == EWOULDBLOCK || errno == EINTR)
-		return;
-	cleanup(0);
-    }
-    nbackp += n;
+	if (n == -1) {
+	    if (errno == EWOULDBLOCK || errno == EINTR)
+		continue;
+	    cleanup(0);
+	    /* NOTREACHED */
+	}
+	nbackp += n;
 #ifdef	ENCRYPTION
-    if (nbackp > nclearto)
-	nclearto = 0;
+	if (nbackp > nclearto)
+	    nclearto = 0;
 #endif	/* ENCRYPTION */
-    if (nbackp >= neturg) {
-	neturg = 0;
-    }
-    if (nbackp == nfrontp) {
-	nbackp = nfrontp = netobuf;
+	if (nbackp >= neturg) {
+	    neturg = 0;
+	}
+	if (nbackp == nfrontp) {
+	    nbackp = nfrontp = netobuf;
 #ifdef	ENCRYPTION
-	nclearto = 0;
+	    nclearto = 0;
 #endif	/* ENCRYPTION */
+	}
     }
     return;
 }  /* end of netflush */
 
 
-/*
- * writenet
- *
- * Just a handy little function to write a bit of raw data to the net.
- * It will force a transmit of the buffer if necessary
- *
- * arguments
- *    ptr - A pointer to a character string to write
- *    len - How many bytes to write
- */
-	void
-writenet(ptr, len)
-	register unsigned char *ptr;
-	register int len;
-{
-	/* flush buffer if no room for new data) */
-	if ((&netobuf[BUFSIZ] - nfrontp) < len) {
-		/* if this fails, don't worry, buffer is a little big */
-		netflush();
-	}
-
-	memmove(nfrontp, ptr, len);
-	nfrontp += len;
-
-}  /* end of writenet */
-
-
 /*
  * miscellaneous functions doing a variety of little jobs follow ...
  */
@@ -554,12 +525,11 @@ printoption(fmt, option)
 	register int option;
 {
 	if (TELOPT_OK(option))
-		sprintf(nfrontp, "%s %s\r\n", fmt, TELOPT(option));
+		output_data("%s %s\r\n", fmt, TELOPT(option));
 	else if (TELCMD_OK(option))
-		sprintf(nfrontp, "%s %s\r\n", fmt, TELCMD(option));
+		output_data("%s %s\r\n", fmt, TELCMD(option));
 	else
-		sprintf(nfrontp, "%s %d\r\n", fmt, option);
-	nfrontp += strlen(nfrontp);
+		output_data("%s %d\r\n", fmt, option);
 	return;
 }
 
@@ -575,9 +545,8 @@ printsub(direction, pointer, length)
 		return;
 
 	if (direction) {
-	    sprintf(nfrontp, "td: %s suboption ",
+	    output_data("td: %s suboption ",
 					direction == '<' ? "recv" : "send");
-	    nfrontp += strlen(nfrontp);
 	    if (length >= 3) {
 		register int j;
 
@@ -585,232 +554,192 @@ printsub(direction, pointer, length)
 		j = pointer[length-1];
 
 		if (i != IAC || j != SE) {
-		    sprintf(nfrontp, "(terminated by ");
-		    nfrontp += strlen(nfrontp);
+		    output_data("(terminated by ");
 		    if (TELOPT_OK(i))
-			sprintf(nfrontp, "%s ", TELOPT(i));
+			output_data("%s ", TELOPT(i));
 		    else if (TELCMD_OK(i))
-			sprintf(nfrontp, "%s ", TELCMD(i));
+			output_data("%s ", TELCMD(i));
 		    else
-			sprintf(nfrontp, "%d ", i);
-		    nfrontp += strlen(nfrontp);
+			output_data("%d ", i);
 		    if (TELOPT_OK(j))
-			sprintf(nfrontp, "%s", TELOPT(j));
+			output_data("%s", TELOPT(j));
 		    else if (TELCMD_OK(j))
-			sprintf(nfrontp, "%s", TELCMD(j));
+			output_data("%s", TELCMD(j));
 		    else
-			sprintf(nfrontp, "%d", j);
-		    nfrontp += strlen(nfrontp);
-		    sprintf(nfrontp, ", not IAC SE!) ");
-		    nfrontp += strlen(nfrontp);
+			output_data("%d", j);
+		    output_data(", not IAC SE!) ");
 		}
 	    }
 	    length -= 2;
 	}
 	if (length < 1) {
-	    sprintf(nfrontp, "(Empty suboption??\?)");
-	    nfrontp += strlen(nfrontp);
+	    output_data("(Empty suboption??\?)");
 	    return;
 	}
 	switch (pointer[0]) {
 	case TELOPT_TTYPE:
-	    sprintf(nfrontp, "TERMINAL-TYPE ");
-	    nfrontp += strlen(nfrontp);
+	    output_data("TERMINAL-TYPE ");
 	    switch (pointer[1]) {
 	    case TELQUAL_IS:
-		sprintf(nfrontp, "IS \"%.*s\"", length-2, (char *)pointer+2);
+		output_data("IS \"%.*s\"", length-2, (char *)pointer+2);
 		break;
 	    case TELQUAL_SEND:
-		sprintf(nfrontp, "SEND");
+		output_data("SEND");
 		break;
 	    default:
-		sprintf(nfrontp,
+		output_data(
 				"- unknown qualifier %d (0x%x).",
 				pointer[1], pointer[1]);
 	    }
-	    nfrontp += strlen(nfrontp);
 	    break;
 	case TELOPT_TSPEED:
-	    sprintf(nfrontp, "TERMINAL-SPEED");
-	    nfrontp += strlen(nfrontp);
+	    output_data("TERMINAL-SPEED");
 	    if (length < 2) {
-		sprintf(nfrontp, " (empty suboption??\?)");
-		nfrontp += strlen(nfrontp);
+		output_data(" (empty suboption??\?)");
 		break;
 	    }
 	    switch (pointer[1]) {
 	    case TELQUAL_IS:
-		sprintf(nfrontp, " IS %.*s", length-2, (char *)pointer+2);
-		nfrontp += strlen(nfrontp);
+		output_data(" IS %.*s", length-2, (char *)pointer+2);
 		break;
 	    default:
 		if (pointer[1] == 1)
-		    sprintf(nfrontp, " SEND");
+		    output_data(" SEND");
 		else
-		    sprintf(nfrontp, " %d (unknown)", pointer[1]);
-		nfrontp += strlen(nfrontp);
+		    output_data(" %d (unknown)", pointer[1]);
 		for (i = 2; i < length; i++) {
-		    sprintf(nfrontp, " ?%d?", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" ?%d?", pointer[i]);
 		}
 		break;
 	    }
 	    break;
 
 	case TELOPT_LFLOW:
-	    sprintf(nfrontp, "TOGGLE-FLOW-CONTROL");
-	    nfrontp += strlen(nfrontp);
+	    output_data("TOGGLE-FLOW-CONTROL");
 	    if (length < 2) {
-		sprintf(nfrontp, " (empty suboption??\?)");
-		nfrontp += strlen(nfrontp);
+		output_data(" (empty suboption??\?)");
 		break;
 	    }
 	    switch (pointer[1]) {
 	    case LFLOW_OFF:
-		sprintf(nfrontp, " OFF"); break;
+		output_data(" OFF"); break;
 	    case LFLOW_ON:
-		sprintf(nfrontp, " ON"); break;
+		output_data(" ON"); break;
 	    case LFLOW_RESTART_ANY:
-		sprintf(nfrontp, " RESTART-ANY"); break;
+		output_data(" RESTART-ANY"); break;
 	    case LFLOW_RESTART_XON:
-		sprintf(nfrontp, " RESTART-XON"); break;
+		output_data(" RESTART-XON"); break;
 	    default:
-		sprintf(nfrontp, " %d (unknown)", pointer[1]);
+		output_data(" %d (unknown)", pointer[1]);
 	    }
-	    nfrontp += strlen(nfrontp);
 	    for (i = 2; i < length; i++) {
-		sprintf(nfrontp, " ?%d?", pointer[i]);
-		nfrontp += strlen(nfrontp);
+		output_data(" ?%d?", pointer[i]);
 	    }
 	    break;
 
 	case TELOPT_NAWS:
-	    sprintf(nfrontp, "NAWS");
-	    nfrontp += strlen(nfrontp);
+	    output_data("NAWS");
 	    if (length < 2) {
-		sprintf(nfrontp, " (empty suboption??\?)");
-		nfrontp += strlen(nfrontp);
+		output_data(" (empty suboption??\?)");
 		break;
 	    }
 	    if (length == 2) {
-		sprintf(nfrontp, " ?%d?", pointer[1]);
-		nfrontp += strlen(nfrontp);
+		output_data(" ?%d?", pointer[1]);
 		break;
 	    }
-	    sprintf(nfrontp, " %d %d (%d)",
+	    output_data(" %d %d (%d)",
 		pointer[1], pointer[2],
 		(int)((((unsigned int)pointer[1])<<8)|((unsigned int)pointer[2])));
-	    nfrontp += strlen(nfrontp);
 	    if (length == 4) {
-		sprintf(nfrontp, " ?%d?", pointer[3]);
-		nfrontp += strlen(nfrontp);
+		output_data(" ?%d?", pointer[3]);
 		break;
 	    }
-	    sprintf(nfrontp, " %d %d (%d)",
+	    output_data(" %d %d (%d)",
 		pointer[3], pointer[4],
 		(int)((((unsigned int)pointer[3])<<8)|((unsigned int)pointer[4])));
-	    nfrontp += strlen(nfrontp);
 	    for (i = 5; i < length; i++) {
-		sprintf(nfrontp, " ?%d?", pointer[i]);
-		nfrontp += strlen(nfrontp);
+		output_data(" ?%d?", pointer[i]);
 	    }
 	    break;
 
 	case TELOPT_LINEMODE:
-	    sprintf(nfrontp, "LINEMODE ");
-	    nfrontp += strlen(nfrontp);
+	    output_data("LINEMODE ");
 	    if (length < 2) {
-		sprintf(nfrontp, " (empty suboption??\?)");
-		nfrontp += strlen(nfrontp);
+		output_data(" (empty suboption??\?)");
 		break;
 	    }
 	    switch (pointer[1]) {
 	    case WILL:
-		sprintf(nfrontp, "WILL ");
+		output_data("WILL ");
 		goto common;
 	    case WONT:
-		sprintf(nfrontp, "WONT ");
+		output_data("WONT ");
 		goto common;
 	    case DO:
-		sprintf(nfrontp, "DO ");
+		output_data("DO ");
 		goto common;
 	    case DONT:
-		sprintf(nfrontp, "DONT ");
+		output_data("DONT ");
 	    common:
-		nfrontp += strlen(nfrontp);
 		if (length < 3) {
-		    sprintf(nfrontp, "(no option??\?)");
-		    nfrontp += strlen(nfrontp);
+		    output_data("(no option??\?)");
 		    break;
 		}
 		switch (pointer[2]) {
 		case LM_FORWARDMASK:
-		    sprintf(nfrontp, "Forward Mask");
-		    nfrontp += strlen(nfrontp);
+		    output_data("Forward Mask");
 		    for (i = 3; i < length; i++) {
-			sprintf(nfrontp, " %x", pointer[i]);
-			nfrontp += strlen(nfrontp);
+			output_data(" %x", pointer[i]);
 		    }
 		    break;
 		default:
-		    sprintf(nfrontp, "%d (unknown)", pointer[2]);
-		    nfrontp += strlen(nfrontp);
+		    output_data("%d (unknown)", pointer[2]);
 		    for (i = 3; i < length; i++) {
-			sprintf(nfrontp, " %d", pointer[i]);
-			nfrontp += strlen(nfrontp);
+			output_data(" %d", pointer[i]);
 		    }
 		    break;
 		}
 		break;
 
 	    case LM_SLC:
-		sprintf(nfrontp, "SLC");
-		nfrontp += strlen(nfrontp);
+		output_data("SLC");
 		for (i = 2; i < length - 2; i += 3) {
 		    if (SLC_NAME_OK(pointer[i+SLC_FUNC]))
-			sprintf(nfrontp, " %s", SLC_NAME(pointer[i+SLC_FUNC]));
+			output_data(" %s", SLC_NAME(pointer[i+SLC_FUNC]));
 		    else
-			sprintf(nfrontp, " %d", pointer[i+SLC_FUNC]);
-		    nfrontp += strlen(nfrontp);
+			output_data(" %d", pointer[i+SLC_FUNC]);
 		    switch (pointer[i+SLC_FLAGS]&SLC_LEVELBITS) {
 		    case SLC_NOSUPPORT:
-			sprintf(nfrontp, " NOSUPPORT"); break;
+			output_data(" NOSUPPORT"); break;
 		    case SLC_CANTCHANGE:
-			sprintf(nfrontp, " CANTCHANGE"); break;
+			output_data(" CANTCHANGE"); break;
 		    case SLC_VARIABLE:
-			sprintf(nfrontp, " VARIABLE"); break;
+			output_data(" VARIABLE"); break;
 		    case SLC_DEFAULT:
-			sprintf(nfrontp, " DEFAULT"); break;
+			output_data(" DEFAULT"); break;
 		    }
-		    nfrontp += strlen(nfrontp);
-		    sprintf(nfrontp, "%s%s%s",
+		    output_data("%s%s%s",
 			pointer[i+SLC_FLAGS]&SLC_ACK ? "|ACK" : "",
 			pointer[i+SLC_FLAGS]&SLC_FLUSHIN ? "|FLUSHIN" : "",
 			pointer[i+SLC_FLAGS]&SLC_FLUSHOUT ? "|FLUSHOUT" : "");
-		    nfrontp += strlen(nfrontp);
 		    if (pointer[i+SLC_FLAGS]& ~(SLC_ACK|SLC_FLUSHIN|
 						SLC_FLUSHOUT| SLC_LEVELBITS)) {
-			sprintf(nfrontp, "(0x%x)", pointer[i+SLC_FLAGS]);
-			nfrontp += strlen(nfrontp);
+			output_data("(0x%x)", pointer[i+SLC_FLAGS]);
 		    }
-		    sprintf(nfrontp, " %d;", pointer[i+SLC_VALUE]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" %d;", pointer[i+SLC_VALUE]);
 		    if ((pointer[i+SLC_VALUE] == IAC) &&
 			(pointer[i+SLC_VALUE+1] == IAC))
 				i++;
 		}
 		for (; i < length; i++) {
-		    sprintf(nfrontp, " ?%d?", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" ?%d?", pointer[i]);
 		}
 		break;
 
 	    case LM_MODE:
-		sprintf(nfrontp, "MODE ");
-		nfrontp += strlen(nfrontp);
+		output_data("MODE ");
 		if (length < 3) {
-		    sprintf(nfrontp, "(no mode??\?)");
-		    nfrontp += strlen(nfrontp);
+		    output_data("(no mode??\?)");
 		    break;
 		}
 		{
@@ -821,24 +750,19 @@ printsub(direction, pointer, length)
 			pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",
 			pointer[2]&MODE_LIT_ECHO ? "|LIT_ECHO" : "",
 			pointer[2]&MODE_ACK ? "|ACK" : "");
-		    sprintf(nfrontp, "%s", tbuf[1] ? &tbuf[1] : "0");
-		    nfrontp += strlen(nfrontp);
+		    output_data("%s", tbuf[1] ? &tbuf[1] : "0");
 		}
 		if (pointer[2]&~(MODE_EDIT|MODE_TRAPSIG|MODE_ACK)) {
-		    sprintf(nfrontp, " (0x%x)", pointer[2]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" (0x%x)", pointer[2]);
 		}
 		for (i = 3; i < length; i++) {
-		    sprintf(nfrontp, " ?0x%x?", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" ?0x%x?", pointer[i]);
 		}
 		break;
 	    default:
-		sprintf(nfrontp, "%d (unknown)", pointer[1]);
-		nfrontp += strlen(nfrontp);
+		output_data("%d (unknown)", pointer[1]);
 		for (i = 2; i < length; i++) {
-		    sprintf(nfrontp, " %d", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" %d", pointer[i]);
 		}
 	    }
 	    break;
@@ -847,24 +771,20 @@ printsub(direction, pointer, length)
 	    register char *cp;
 	    register int j, k;
 
-	    sprintf(nfrontp, "STATUS");
-	    nfrontp += strlen(nfrontp);
+	    output_data("STATUS");
 
 	    switch (pointer[1]) {
 	    default:
 		if (pointer[1] == TELQUAL_SEND)
-		    sprintf(nfrontp, " SEND");
+		    output_data(" SEND");
 		else
-		    sprintf(nfrontp, " %d (unknown)", pointer[1]);
-		nfrontp += strlen(nfrontp);
+		    output_data(" %d (unknown)", pointer[1]);
 		for (i = 2; i < length; i++) {
-		    sprintf(nfrontp, " ?%d?", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" ?%d?", pointer[i]);
 		}
 		break;
 	    case TELQUAL_IS:
-		sprintf(nfrontp, " IS\r\n");
-		nfrontp += strlen(nfrontp);
+		output_data(" IS\r\n");
 
 		for (i = 2; i < length; i++) {
 		    switch(pointer[i]) {
@@ -875,18 +795,15 @@ printsub(direction, pointer, length)
 		    common2:
 			i++;
 			if (TELOPT_OK(pointer[i]))
-			    sprintf(nfrontp, " %s %s", cp, TELOPT(pointer[i]));
+			    output_data(" %s %s", cp, TELOPT(pointer[i]));
 			else
-			    sprintf(nfrontp, " %s %d", cp, pointer[i]);
-			nfrontp += strlen(nfrontp);
+			    output_data(" %s %d", cp, pointer[i]);
 
-			sprintf(nfrontp, "\r\n");
-			nfrontp += strlen(nfrontp);
+			output_data("\r\n");
 			break;
 
 		    case SB:
-			sprintf(nfrontp, " SB ");
-			nfrontp += strlen(nfrontp);
+			output_data(" SB ");
 			i++;
 			j = k = i;
 			while (j < length) {
@@ -902,20 +819,17 @@ printsub(direction, pointer, length)
 			}
 			printsub(0, &pointer[i], k - i);
 			if (i < length) {
-			    sprintf(nfrontp, " SE");
-			    nfrontp += strlen(nfrontp);
+			    output_data(" SE");
 			    i = j;
 			} else
 			    i = j - 1;
 
-			sprintf(nfrontp, "\r\n");
-			nfrontp += strlen(nfrontp);
+			output_data("\r\n");
 
 			break;
 
 		    default:
-			sprintf(nfrontp, " %d", pointer[i]);
-			nfrontp += strlen(nfrontp);
+			output_data(" %d", pointer[i]);
 			break;
 		    }
 		}
@@ -925,86 +839,77 @@ printsub(direction, pointer, length)
 	  }
 
 	case TELOPT_XDISPLOC:
-	    sprintf(nfrontp, "X-DISPLAY-LOCATION ");
-	    nfrontp += strlen(nfrontp);
+	    output_data("X-DISPLAY-LOCATION ");
 	    switch (pointer[1]) {
 	    case TELQUAL_IS:
-		sprintf(nfrontp, "IS \"%.*s\"", length-2, (char *)pointer+2);
+		output_data("IS \"%.*s\"", length-2, (char *)pointer+2);
 		break;
 	    case TELQUAL_SEND:
-		sprintf(nfrontp, "SEND");
+		output_data("SEND");
 		break;
 	    default:
-		sprintf(nfrontp, "- unknown qualifier %d (0x%x).",
+		output_data("- unknown qualifier %d (0x%x).",
 				pointer[1], pointer[1]);
 	    }
-	    nfrontp += strlen(nfrontp);
 	    break;
 
 	case TELOPT_NEW_ENVIRON:
-	    sprintf(nfrontp, "NEW-ENVIRON ");
+	    output_data("NEW-ENVIRON ");
 	    goto env_common1;
 	case TELOPT_OLD_ENVIRON:
-	    sprintf(nfrontp, "OLD-ENVIRON");
+	    output_data("OLD-ENVIRON");
 	env_common1:
-	    nfrontp += strlen(nfrontp);
 	    switch (pointer[1]) {
 	    case TELQUAL_IS:
-		sprintf(nfrontp, "IS ");
+		output_data("IS ");
 		goto env_common;
 	    case TELQUAL_SEND:
-		sprintf(nfrontp, "SEND ");
+		output_data("SEND ");
 		goto env_common;
 	    case TELQUAL_INFO:
-		sprintf(nfrontp, "INFO ");
+		output_data("INFO ");
 	    env_common:
-		nfrontp += strlen(nfrontp);
 		{
 		    register int noquote = 2;
 		    for (i = 2; i < length; i++ ) {
 			switch (pointer[i]) {
 			case NEW_ENV_VAR:
-			    sprintf(nfrontp, "\" VAR " + noquote);
-			    nfrontp += strlen(nfrontp);
+			    output_data("\" VAR " + noquote);
 			    noquote = 2;
 			    break;
 
 			case NEW_ENV_VALUE:
-			    sprintf(nfrontp, "\" VALUE " + noquote);
-			    nfrontp += strlen(nfrontp);
+			    output_data("\" VALUE " + noquote);
 			    noquote = 2;
 			    break;
 
 			case ENV_ESC:
-			    sprintf(nfrontp, "\" ESC " + noquote);
-			    nfrontp += strlen(nfrontp);
+			    output_data("\" ESC " + noquote);
 			    noquote = 2;
 			    break;
 
 			case ENV_USERVAR:
-			    sprintf(nfrontp, "\" USERVAR " + noquote);
-			    nfrontp += strlen(nfrontp);
+			    output_data("\" USERVAR " + noquote);
 			    noquote = 2;
 			    break;
 
 			default:
 			    if (isprint(pointer[i]) && pointer[i] != '"') {
 				if (noquote) {
-				    *nfrontp++ = '"';
+				    output_data("\"");
 				    noquote = 0;
 				}
-				*nfrontp++ = pointer[i];
+				output_data("%c", pointer[i]);
 			    } else {
-				sprintf(nfrontp, "\" %03o " + noquote,
+				output_data("\" %03o " + noquote,
 							pointer[i]);
-				nfrontp += strlen(nfrontp);
 				noquote = 2;
 			    }
 			    break;
 			}
 		    }
 		    if (!noquote)
-			*nfrontp++ = '"';
+			output_data("\"");
 		    break;
 		}
 	    }
@@ -1012,83 +917,66 @@ printsub(direction, pointer, length)
 
 #if	defined(AUTHENTICATION)
 	case TELOPT_AUTHENTICATION:
-	    sprintf(nfrontp, "AUTHENTICATION");
-	    nfrontp += strlen(nfrontp);
+	    output_data("AUTHENTICATION");
 
 	    if (length < 2) {
-		sprintf(nfrontp, " (empty suboption??\?)");
-		nfrontp += strlen(nfrontp);
+		output_data(" (empty suboption??\?)");
 		break;
 	    }
 	    switch (pointer[1]) {
 	    case TELQUAL_REPLY:
 	    case TELQUAL_IS:
-		sprintf(nfrontp, " %s ", (pointer[1] == TELQUAL_IS) ?
+		output_data(" %s ", (pointer[1] == TELQUAL_IS) ?
 							"IS" : "REPLY");
-		nfrontp += strlen(nfrontp);
 		if (AUTHTYPE_NAME_OK(pointer[2]))
-		    sprintf(nfrontp, "%s ", AUTHTYPE_NAME(pointer[2]));
+		    output_data("%s ", AUTHTYPE_NAME(pointer[2]));
 		else
-		    sprintf(nfrontp, "%d ", pointer[2]);
-		nfrontp += strlen(nfrontp);
+		    output_data("%d ", pointer[2]);
 		if (length < 3) {
-		    sprintf(nfrontp, "(partial suboption??\?)");
-		    nfrontp += strlen(nfrontp);
+		    output_data("(partial suboption??\?)");
 		    break;
 		}
-		sprintf(nfrontp, "%s|%s",
+		output_data("%s|%s",
 			((pointer[3] & AUTH_WHO_MASK) == AUTH_WHO_CLIENT) ?
 			"CLIENT" : "SERVER",
 			((pointer[3] & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL) ?
 			"MUTUAL" : "ONE-WAY");
-		nfrontp += strlen(nfrontp);
 
     		{
 		    char buf[512];
 		    auth_printsub(&pointer[1], length - 1, buf, sizeof(buf));
-		    sprintf(nfrontp, "%s", buf);
+		    output_data("%s", buf);
 		}
-		nfrontp += strlen(nfrontp);
 		break;
 
 	    case TELQUAL_SEND:
 		i = 2;
-		sprintf(nfrontp, " SEND ");
-		nfrontp += strlen(nfrontp);
+		output_data(" SEND ");
 		while (i < length) {
 		    if (AUTHTYPE_NAME_OK(pointer[i]))
-			sprintf(nfrontp, "%s ", AUTHTYPE_NAME(pointer[i]));
+			output_data("%s ", AUTHTYPE_NAME(pointer[i]));
 		    else
-			sprintf(nfrontp, "%d ", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+			output_data("%d ", pointer[i]);
 		    if (++i >= length) {
-			sprintf(nfrontp, "(partial suboption??\?)");
-			nfrontp += strlen(nfrontp);
+			output_data("(partial suboption??\?)");
 			break;
 		    }
-		    sprintf(nfrontp, "%s|%s ",
+		    output_data("%s|%s ",
 			((pointer[i] & AUTH_WHO_MASK) == AUTH_WHO_CLIENT) ?
 							"CLIENT" : "SERVER",
 			((pointer[i] & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL) ?
 							"MUTUAL" : "ONE-WAY");
-		    nfrontp += strlen(nfrontp);
 		    ++i;
 		}
 		break;
 
 	    case TELQUAL_NAME:
-		i = 2;
-		sprintf(nfrontp, " NAME \"");
-		nfrontp += strlen(nfrontp);
-		while (i < length)
-		    *nfrontp += pointer[i++];
-		*nfrontp += '"';
+		output_data(" NAME \"%.*s\"", length - 2, pointer + 2);
 		break;
 
 	    default:
 		    for (i = 2; i < length; i++) {
-			sprintf(nfrontp, " ?%d?", pointer[i]);
-			nfrontp += strlen(nfrontp);
+			output_data(" ?%d?", pointer[i]);
 		    }
 		    break;
 	    }
@@ -1097,89 +985,73 @@ printsub(direction, pointer, length)
 
 #ifdef	ENCRYPTION
 	case TELOPT_ENCRYPT:
-	    sprintf(nfrontp, "ENCRYPT");
-	    nfrontp += strlen(nfrontp);
+	    output_data("ENCRYPT");
 	    if (length < 2) {
-		sprintf(nfrontp, " (empty suboption??\?)");
-		nfrontp += strlen(nfrontp);
+		output_data(" (empty suboption??\?)");
 		break;
 	    }
 	    switch (pointer[1]) {
 	    case ENCRYPT_START:
-		sprintf(nfrontp, " START");
-		nfrontp += strlen(nfrontp);
+		output_data(" START");
 		break;
 
 	    case ENCRYPT_END:
-		sprintf(nfrontp, " END");
-		nfrontp += strlen(nfrontp);
+		output_data(" END");
 		break;
 
 	    case ENCRYPT_REQSTART:
-		sprintf(nfrontp, " REQUEST-START");
-		nfrontp += strlen(nfrontp);
+		output_data(" REQUEST-START");
 		break;
 
 	    case ENCRYPT_REQEND:
-		sprintf(nfrontp, " REQUEST-END");
-		nfrontp += strlen(nfrontp);
+		output_data(" REQUEST-END");
 		break;
 
 	    case ENCRYPT_IS:
 	    case ENCRYPT_REPLY:
-		sprintf(nfrontp, " %s ", (pointer[1] == ENCRYPT_IS) ?
+		output_data(" %s ", (pointer[1] == ENCRYPT_IS) ?
 							"IS" : "REPLY");
-		nfrontp += strlen(nfrontp);
 		if (length < 3) {
-		    sprintf(nfrontp, " (partial suboption??\?)");
-		    nfrontp += strlen(nfrontp);
+		    output_data(" (partial suboption??\?)");
 		    break;
 		}
 		if (ENCTYPE_NAME_OK(pointer[2]))
-		    sprintf(nfrontp, "%s ", ENCTYPE_NAME(pointer[2]));
+		    output_data("%s ", ENCTYPE_NAME(pointer[2]));
 		else
-		    sprintf(nfrontp, " %d (unknown)", pointer[2]);
-		nfrontp += strlen(nfrontp);
+		    output_data(" %d (unknown)", pointer[2]);
 
 		{
 		    char buf[512];
 		    encrypt_printsub(&pointer[1], length - 1, buf, sizeof(buf));
-		    sprintf(nfrontp, "%s", buf);
+		    output_data("%s", buf);
 		}
-		nfrontp += strlen(nfrontp);
 		break;
 
 	    case ENCRYPT_SUPPORT:
 		i = 2;
-		sprintf(nfrontp, " SUPPORT ");
-		nfrontp += strlen(nfrontp);
+		output_data(" SUPPORT ");
 		while (i < length) {
 		    if (ENCTYPE_NAME_OK(pointer[i]))
-			sprintf(nfrontp, "%s ", ENCTYPE_NAME(pointer[i]));
+			output_data("%s ", ENCTYPE_NAME(pointer[i]));
 		    else
-			sprintf(nfrontp, "%d ", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+			output_data("%d ", pointer[i]);
 		    i++;
 		}
 		break;
 
 	    case ENCRYPT_ENC_KEYID:
-		sprintf(nfrontp, " ENC_KEYID");
-		nfrontp += strlen(nfrontp);
+		output_data(" ENC_KEYID");
 		goto encommon;
 
 	    case ENCRYPT_DEC_KEYID:
-		sprintf(nfrontp, " DEC_KEYID");
-		nfrontp += strlen(nfrontp);
+		output_data(" DEC_KEYID");
 		goto encommon;
 
 	    default:
-		sprintf(nfrontp, " %d (unknown)", pointer[1]);
-		nfrontp += strlen(nfrontp);
+		output_data(" %d (unknown)", pointer[1]);
 	    encommon:
 		for (i = 2; i < length; i++) {
-		    sprintf(nfrontp, " %d", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" %d", pointer[i]);
 		}
 		break;
 	    }
@@ -1188,18 +1060,15 @@ printsub(direction, pointer, length)
 
 	default:
 	    if (TELOPT_OK(pointer[0]))
-		sprintf(nfrontp, "%s (unknown)", TELOPT(pointer[0]));
+		output_data("%s (unknown)", TELOPT(pointer[0]));
 	    else
-		sprintf(nfrontp, "%d (unknown)", pointer[i]);
-	    nfrontp += strlen(nfrontp);
+		output_data("%d (unknown)", pointer[i]);
 	    for (i = 1; i < length; i++) {
-		sprintf(nfrontp, " %d", pointer[i]);
-		nfrontp += strlen(nfrontp);
+		output_data(" %d", pointer[i]);
 	    }
 	    break;
 	}
-	sprintf(nfrontp, "\r\n");
-	nfrontp += strlen(nfrontp);
+	output_data("\r\n");
 }
 
 /*
@@ -1221,26 +1090,22 @@ printdata(tag, ptr, cnt)
 		}
 
 		/* add a line of output */
-		sprintf(nfrontp, "%s: ", tag);
-		nfrontp += strlen(nfrontp);
+		output_data("%s: ", tag);
 		for (i = 0; i < 20 && cnt; i++) {
-			sprintf(nfrontp, "%02x", *ptr);
-			nfrontp += strlen(nfrontp);
+			output_data("%02x", *ptr);
 			if (isprint(*ptr)) {
 				xbuf[i] = *ptr;
 			} else {
 				xbuf[i] = '.';
 			}
 			if (i % 2) {
-				*nfrontp = ' ';
-				nfrontp++;
+				output_data(" ");
 			}
 			cnt--;
 			ptr++;
 		}
 		xbuf[i] = '\0';
-		sprintf(nfrontp, " %s\r\n", xbuf );
-		nfrontp += strlen(nfrontp);
+		output_data(" %s\r\n", xbuf );
 	}
 }
 #endif /* DIAGNOSTICS */

etc/periodic/daily/410.status-uucp

@@ -27,7 +27,7 @@ case "$daily_status_uucp_enable" in
 	    echo ""
 	    echo "UUCP status:"
 
-	    uustat -a && rc=0 || rc=3
+	    (echo "/usr/bin/uustat -a" | su -fm uucp ) && rc=0 || rc=3
 	fi;;
 
     *)  rc=0;;

gnu/libexec/uucp/cu/Makefile

@@ -12,6 +12,7 @@ LDADD+=		$(LIBUNIX) $(LIBUUCONF) $(LIBUUCP)
 DPADD+=		$(LIBUNIX) $(LIBUUCONF) $(LIBUUCP)
 CFLAGS+=	-I$(.CURDIR)/../common_sources\
 		-DVERSION=\"$(VERSION)\"
+INSTALLFLAGS+= -fschg
 
 .include <bsd.prog.mk>
 .PATH: $(.CURDIR)/../common_sources

gnu/libexec/uucp/uucp/Makefile

@@ -11,6 +11,7 @@ LDADD+=		$(LIBUNIX) $(LIBUUCONF) $(LIBUUCP)
 DPADD+=		$(LIBUNIX) $(LIBUUCONF) $(LIBUUCP)
 CFLAGS+=	-I$(.CURDIR)/../common_sources\
 		-DVERSION=\"$(VERSION)\"
+INSTALLFLAGS+= -fschg
 
 .include <bsd.prog.mk>
 .PATH: $(.CURDIR)/../common_sources

gnu/libexec/uucp/uuname/Makefile

@@ -11,7 +11,7 @@ LDADD+=		$(LIBUNIX) $(LIBUUCONF) $(LIBUUCP)
 DPADD+=		$(LIBUNIX) $(LIBUUCONF) $(LIBUUCP)
 CFLAGS+=	-I$(.CURDIR)/../common_sources\
 		-DVERSION=\"$(VERSION)\"
-
+INSTALLFLAGS+= -fschg
 
 .include <bsd.prog.mk>
 .PATH: $(.CURDIR)/../common_sources

gnu/libexec/uucp/uustat/Makefile

@@ -13,6 +13,7 @@ DPADD+=		$(LIBUNIX) $(LIBUUCONF) $(LIBUUCP)
 CFLAGS+=	-I$(.CURDIR)/../common_sources\
 		-DOWNER=\"$(owner)\"\
 		-DVERSION=\"$(VERSION)\"
+INSTALLFLAGS+= -fschg
 
 .include <bsd.prog.mk>
 .PATH: $(.CURDIR)/../common_sources

gnu/libexec/uucp/uux/Makefile

@@ -11,6 +11,7 @@ LDADD+=		$(LIBUNIX) $(LIBUUCONF) $(LIBUUCP)
 DPADD+=		$(LIBUNIX) $(LIBUUCONF) $(LIBUUCP)
 CFLAGS+=	-I$(.CURDIR)/../common_sources\
 		-DVERSION=\"$(VERSION)\"
+INSTALLFLAGS+= -fschg
 
 .include <bsd.prog.mk>
 .PATH: $(.CURDIR)/../common_sources

gnu/usr.bin/gzip/zdiff

@@ -47,10 +47,11 @@ elif test $# -eq 2; then
                 case "$2" in
 	        *[-.]gz* | *[-.][zZ] | *.t[ga]z)
 			F=`echo "$2" | sed 's|.*/||;s|[-.][zZtga]*||'`
-                        gzip -cdfq "$2" > /tmp/"$F".$$
-                        gzip -cdfq "$1" | $comp $OPTIONS - /tmp/"$F".$$
+                        tmp=`mktemp -t "$F"`
+                        gzip -cdfq "$2" > "$tmp"
+                        gzip -cdfq "$1" | $comp $OPTIONS - "$tmp"
                         STAT="$?"
-			/bin/rm -f /tmp/"$F".$$;;
+			/bin/rm -f "$tmp";;
 
                 *)      gzip -cdfq "$1" | $comp $OPTIONS - "$2"
                         STAT="$?";;

gnu/usr.bin/gzip/znew

@@ -14,24 +14,28 @@ block=1024
 # block is the disk block size (best guess, need not be exact)
 
 warn="(does not preserve modes and timestamp)"
-tmp=/tmp/zfoo.$$
-echo hi > $tmp.1
-echo hi > $tmp.2
-if test -z "`(${CPMOD-cpmod} $tmp.1 $tmp.2) 2>&1`"; then
+tmp=`mktemp -d -t znew`
+if test -z "$tmp"; then
+  echo znew: could not create temporary directory
+  exit 1
+fi
+echo hi > $tmp/1
+echo hi > $tmp/2
+if test -z "`(${CPMOD-cpmod} $tmp/1 $tmp/2) 2>&1`"; then
   cpmod=${CPMOD-cpmod}
   warn=""
 fi
 
-if test -z "$cpmod" && ${TOUCH-touch} -r $tmp.1 $tmp.2 2>/dev/null; then
+if test -z "$cpmod" && ${TOUCH-touch} -r $tmp/1 $tmp/2 2>/dev/null; then
   cpmod="${TOUCH-touch}"
   cpmodarg="-r"
   warn="(does not preserve file modes)"
 fi
 
 # check if GZIP env. variable uses -S or --suffix
-gzip -q $tmp.1
-ext=`echo $tmp.1* | sed "s|$tmp.1||"`
-rm -f $tmp.[12]*
+gzip -q $tmp/1
+ext=`echo $tmp/1* | sed "s|$tmp/1||"`
+rm -rf $tmp
 if test -z "$ext"; then
   echo znew: error determining gzip extension
   exit 1

lib/libalias/alias_irc.c

@@ -213,6 +213,12 @@ lFOUND_CTCP:
 			 true_addr.s_addr = htonl(org_addr);
 			 destaddr.s_addr = 0;
 
+			 /* Sanity/Security checking */
+			 if (!org_addr || !org_port ||
+			     pip->ip_src.s_addr != true_addr.s_addr ||
+			     org_port < IPPORT_RESERVED)
+				 goto lBAD_CTCP;
+
 			 /* Steal the FTP_DATA_PORT - it doesn't really matter, and this
 				 would probably allow it through at least _some_
 				 firewalls. */

lib/libc/gen/fts.c

@@ -63,7 +63,7 @@ static void	 fts_padjust __P((FTS *, FTSENT *));
 static int	 fts_palloc __P((FTS *, size_t));
 static FTSENT	*fts_sort __P((FTS *, FTSENT *, int));
 static u_short	 fts_stat __P((FTS *, FTSENT *, int));
-static int	 fts_safe_changedir __P((FTS *, FTSENT *, int));
+static int	 fts_safe_changedir __P((FTS *, FTSENT *, int, char *));
 
 #define	ISDOT(a)	(a[0] == '.' && (!a[1] || (a[1] == '.' && !a[2])))
 
@@ -71,7 +71,6 @@ static int	 fts_safe_changedir __P((FTS *, FTSENT *, int));
 #define	ISSET(opt)	(sp->fts_options & (opt))
 #define	SET(opt)	(sp->fts_options |= (opt))
 
-#define	CHDIR(sp, path)	(!ISSET(FTS_NOCHDIR) && chdir(path))
 #define	FCHDIR(sp, fd)	(!ISSET(FTS_NOCHDIR) && fchdir(fd))
 
 /* fts_build flags */
@@ -275,6 +274,7 @@ FTSENT *
 fts_read(sp)
 	register FTS *sp;
 {
+	struct stat sb;
 	register FTSENT *p, *tmp;
 	register int instr;
 	register char *t;
@@ -351,7 +351,7 @@ fts_read(sp)
 		 * FTS_STOP or the fts_info field of the node.
 		 */
 		if (sp->fts_child != NULL) {
-			if (fts_safe_changedir(sp, p, -1)) {
+			if (fts_safe_changedir(sp, p, -1, p->fts_accpath)) {
 				p->fts_errno = errno;
 				p->fts_flags |= FTS_DONTCHDIR;
 				for (p = sp->fts_child; p != NULL; 
@@ -449,11 +449,10 @@ name:		t = sp->fts_path + NAPPEND(p->fts_parent);
 			return (NULL);
 		}
 		(void)_close(p->fts_symfd);
-	} else if (!(p->fts_flags & FTS_DONTCHDIR)) {
-		if (CHDIR(sp, "..")) {
-			SET(FTS_STOP);
-			return (NULL);
-		}
+	} else if (!(p->fts_flags & FTS_DONTCHDIR) &&
+		   fts_safe_changedir(sp, p->fts_parent, -1, "..")) {
+		SET(FTS_STOP);
+		return (NULL);
 	}
 	p->fts_info = p->fts_errno ? FTS_ERR : FTS_DP;
 	return (sp->fts_cur = p);
@@ -640,7 +639,7 @@ fts_build(sp, type)
 	 */
 	cderrno = 0;
 	if (nlinks || type == BREAD) {
-		if (fts_safe_changedir(sp, cur, dirfd(dirp))) {
+		if (fts_safe_changedir(sp, cur, dirfd(dirp), NULL)) {
 			if (nlinks && type == BREAD)
 				cur->fts_errno = errno;
 			cur->fts_flags |= FTS_DONTCHDIR;
@@ -806,7 +805,8 @@ mem1:				saved_errno = errno;
 	 */
 	if (descend && (type == BCHILD || !nitems) &&
 	    (cur->fts_level == FTS_ROOTLEVEL ?
-	    FCHDIR(sp, sp->fts_rfd) : CHDIR(sp, ".."))) {
+	    FCHDIR(sp, sp->fts_rfd) :
+	    fts_safe_changedir(sp, cur->fts_parent, -1, ".."))) {
 		cur->fts_info = FTS_ERR;
 		SET(FTS_STOP);
 		return (NULL);
@@ -1069,10 +1069,11 @@ fts_maxarglen(argv)
  * Assumes p->fts_dev and p->fts_ino are filled in.
  */
 static int
-fts_safe_changedir(sp, p, fd)
+fts_safe_changedir(sp, p, fd, path)
 	FTS *sp;
 	FTSENT *p;
 	int fd;
+	char *path;
 {
 	int ret, oerrno, newfd;
 	struct stat sb;
@@ -1080,7 +1081,7 @@ fts_safe_changedir(sp, p, fd)
 	newfd = fd;
 	if (ISSET(FTS_NOCHDIR))
 		return (0);
-	if (fd < 0 && (newfd = _open(p->fts_accpath, O_RDONLY, 0)) < 0)
+	if (fd < 0 && (newfd = _open(path, O_RDONLY, 0)) < 0)
 		return (-1);
 	if (fstat(newfd, &sb)) {
 		ret = -1;

lib/libc/net/gethostbydns.c

@@ -389,6 +389,7 @@ gethostanswer(answer, anslen, qname, qtype)
 				buflen -= nn;
 			}
 
+			buflen -= sizeof(align) - ((u_long)bp % sizeof(align));
 			bp += sizeof(align) - ((u_long)bp % sizeof(align));
 
 			if (bp + n >= &hostbuf[sizeof hostbuf]) {

lib/libc/net/getnetbydns.c

@@ -173,7 +173,9 @@ static	char *net_aliases[MAXALIASES], netbuf[PACKETSZ];
 			}
 			cp += n; 
 			*ap++ = bp;
-			bp += strlen(bp) + 1;
+			n = strlen(bp) + 1;
+			bp += n;
+			buflen -= n;
 			net_entry.n_addrtype =
 				(class == C_IN) ? AF_INET : AF_UNSPEC;
 			haveanswer++;

lib/libc/net/name6.c

@@ -1024,7 +1024,7 @@ getanswer(answer, anslen, qname, qtype, template, errp)
 	register const u_char *cp;
 	register int n;
 	const u_char *eom, *erdata;
-	char *bp, **ap, **hap;
+	char *bp, **ap, **hap, *obp;
 	int type, class, buflen, ancount, qdcount;
 	int haveanswer, had_error;
 	char tbuf[MAXDNAME];
@@ -1238,7 +1238,9 @@ getanswer(answer, anslen, qname, qtype, template, errp)
 				bp += nn;
 				buflen -= nn;
 			}
+			obp = bp; /* ALIGN rounds up */
 			bp = (char *)ALIGN(bp);
+			buflen -= (bp - obp);
 
 			DNS_FATAL(bp + n < &hostbuf[sizeof hostbuf]);
 			DNS_ASSERT(hap < &h_addr_ptrs[MAXADDRS-1]);

lib/libc/stdlib/realpath.c

@@ -138,7 +138,8 @@ loop:
 		rootd = 0;
 
 	if (*wbuf) {
-		if (strlen(resolved) + strlen(wbuf) + rootd + 1 > MAXPATHLEN) {
+		if (strlen(resolved) + strlen(wbuf) + (1-rootd) + 1 >
+		    MAXPATHLEN) {
 			errno = ENAMETOOLONG;
 			goto err1;
 		}

lib/libutil/login.conf.5

@@ -60,6 +60,8 @@ to set user-defined environment settings which override those specified
 in the system login capabilities database.
 Only a subset of login capabilities may be overridden, typically those
 which do not involve authentication, resource limits and accounting.
+NOTE: this feature is compile-time disabled by default due to potential
+security risks.
 .Pp
 Records in a class capabilities database consist of a number of
 colon-separated fields.

lib/libutil/login_cap.c

@@ -193,8 +193,15 @@ login_getclassbyname(char const *name, const struct passwd *pwd)
 
 	static char *login_dbarray[] = { NULL, NULL, NULL };
 
-	/* Switch to user mode before checking/reading its ~/.login_conf */
-	/* - some NFSes have root read access disabled.                  */
+#ifndef _FILE_LOGIN_CONF_WORKS
+	dir = NULL;
+#endif
+	/*
+	 * Switch to user mode before checking/reading its ~/.login_conf
+	 * - some NFSes have root read access disabled.
+	 *
+	 * XXX: This fails to configure additional groups.
+	 */
 	if (dir) {
 	    euid = geteuid();
 	    egid = getegid();

lib/libz/deflate.c

@@ -242,7 +242,7 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
         windowBits = -windowBits;
     }
     if (memLevel < 1 || memLevel > MAX_MEM_LEVEL || method != Z_DEFLATED ||
-        windowBits < 8 || windowBits > 15 || level < 0 || level > 9 ||
+        windowBits < 9 || windowBits > 15 || level < 0 || level > 9 ||
 	strategy < 0 || strategy > Z_HUFFMAN_ONLY) {
         return Z_STREAM_ERROR;
     }

lib/libz/infblock.c

@@ -1,6 +1,8 @@
 /* infblock.c -- interpret and process block types to last block
  * Copyright (C) 1995-1998 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h 
+ *
+ * $FreeBSD$
  */
 
 #include "zutil.h"
@@ -249,10 +251,11 @@ int r;
                              &s->sub.trees.tb, s->hufts, z);
       if (t != Z_OK)
       {
-        ZFREE(z, s->sub.trees.blens);
         r = t;
-        if (r == Z_DATA_ERROR)
+        if (r == Z_DATA_ERROR) {
+          ZFREE(z, s->sub.trees.blens);
           s->mode = BAD;
+	}
         LEAVE
       }
       s->sub.trees.index = 0;
@@ -313,11 +316,12 @@ int r;
         t = inflate_trees_dynamic(257 + (t & 0x1f), 1 + ((t >> 5) & 0x1f),
                                   s->sub.trees.blens, &bl, &bd, &tl, &td,
                                   s->hufts, z);
-        ZFREE(z, s->sub.trees.blens);
         if (t != Z_OK)
         {
-          if (t == (uInt)Z_DATA_ERROR)
+          if (t == (uInt)Z_DATA_ERROR) {
+            ZFREE(z, s->sub.trees.blens);
             s->mode = BAD;
+	}
           r = t;
           LEAVE
         }
@@ -329,6 +333,7 @@ int r;
         }
         s->sub.decode.codes = c;
       }
+      ZFREE(z, s->sub.trees.blens);
       s->mode = CODES;
     case CODES:
       UPDATE

libexec/telnetd/ext.h

@@ -76,7 +76,7 @@ extern char	ptyobuf[BUFSIZ+NETSLOP], *pfrontp, *pbackp;
 
 extern char	netibuf[BUFSIZ], *netip;
 
-extern char	netobuf[BUFSIZ+NETSLOP], *nfrontp, *nbackp;
+extern char	netobuf[BUFSIZ], *nfrontp, *nbackp;
 extern char	*neturg;		/* one past last bye of urgent data */
 
 extern int	pcc, ncc;
@@ -189,8 +189,10 @@ extern void
 	tty_setsofttab P((int)),
 	tty_tspeed P((int)),
 	willoption P((int)),
-	wontoption P((int)),
-	writenet P((unsigned char *, int));
+	wontoption P((int));
+
+int	output_data __P((const char *, ...)) __printflike(1, 2);
+void	output_datalen __P((const char *, int));
 
 
 

libexec/telnetd/slc.c

@@ -176,7 +176,6 @@ end_slc(bufp)
 	register unsigned char **bufp;
 {
 	register int len;
-	void netflush();
 
 	/*
 	 * If a change has occured, store the new terminal control
@@ -204,7 +203,7 @@ end_slc(bufp)
 			(void) sprintf((char *)slcptr, "%c%c", IAC, SE);
 			slcptr += 2;
 			len = slcptr - slcbuf;
-			writenet(slcbuf, len);
+			output_datalen(slcbuf, len);
 			netflush();  /* force it out immediately */
 			DIAG(TD_OPTIONS, printsub('>', slcbuf+2, len-2););
 		}

libexec/telnetd/state.c

@@ -39,6 +39,7 @@ static const char rcsid[] =
   "$FreeBSD$";
 #endif /* not lint */
 
+#include <stdarg.h>
 #include "telnetd.h"
 #if	defined(AUTHENTICATION)
 #include <libtelnet/auth.h>
@@ -190,8 +191,7 @@ gotiac:			switch (c) {
 				}
 
 				netclear();	/* clear buffer back */
-				*nfrontp++ = IAC;
-				*nfrontp++ = DM;
+				output_data("%c%c", IAC, DM);
 				neturg = nfrontp-1; /* off by one XXX */
 				DIAG(TD_OPTIONS,
 					printoption("td: send IAC", DM));
@@ -444,8 +444,7 @@ send_do(option, init)
 			set_his_want_state_will(option);
 		do_dont_resp[option]++;
 	}
-	(void) sprintf(nfrontp, (char *)doopt, option);
-	nfrontp += sizeof (dont) - 2;
+	output_data((const char *)doopt, option);
 
 	DIAG(TD_OPTIONS, printoption("td: send do", option));
 }
@@ -650,8 +649,7 @@ send_dont(option, init)
 		set_his_want_state_wont(option);
 		do_dont_resp[option]++;
 	}
-	(void) sprintf(nfrontp, (char *)dont, option);
-	nfrontp += sizeof (doopt) - 2;
+	output_data((const char *)dont, option);
 
 	DIAG(TD_OPTIONS, printoption("td: send dont", option));
 }
@@ -800,8 +798,7 @@ send_will(option, init)
 		set_my_want_state_will(option);
 		will_wont_resp[option]++;
 	}
-	(void) sprintf(nfrontp, (char *)will, option);
-	nfrontp += sizeof (doopt) - 2;
+	output_data((const char *)will, option);
 
 	DIAG(TD_OPTIONS, printoption("td: send will", option));
 }
@@ -954,8 +951,7 @@ send_wont(option, init)
 		set_my_want_state_wont(option);
 		will_wont_resp[option]++;
 	}
-	(void) sprintf(nfrontp, (char *)wont, option);
-	nfrontp += sizeof (wont) - 2;
+	output_data((const char *)wont, option);
 
 	DIAG(TD_OPTIONS, printoption("td: send wont", option));
 }
@@ -1351,9 +1347,8 @@ suboption()
 	    env_ovar_wrong:
 			env_ovar = OLD_ENV_VALUE;
 			env_ovalue = OLD_ENV_VAR;
-			DIAG(TD_OPTIONS, {sprintf(nfrontp,
-				"ENVIRON VALUE and VAR are reversed!\r\n");
-				nfrontp += strlen(nfrontp);});
+			DIAG(TD_OPTIONS,
+			    output_data("ENVIRON VALUE and VAR are reversed!\r\n"));
 
 		}
 	    }
@@ -1542,9 +1537,55 @@ send_status()
 	ADD(IAC);
 	ADD(SE);
 
-	writenet(statusbuf, ncp - statusbuf);
+	output_datalen(statusbuf, ncp - statusbuf);
 	netflush();	/* Send it on its way */
 
 	DIAG(TD_OPTIONS,
 		{printsub('>', statusbuf, ncp - statusbuf); netflush();});
 }
+
+/*
+ * This function appends data to nfrontp and advances nfrontp.
+ * Returns the number of characters written altogether (the
+ * buffer may have been flushed in the process).
+ */
+
+int
+output_data(const char *format, ...)
+{
+	va_list args;
+	int len;
+	char *buf;
+
+	va_start(args, format);
+	if ((len = vasprintf(&buf, format, args)) == -1)
+		return -1;
+	output_datalen(buf, len);
+	va_end(args);
+	free(buf);
+	return (len);
+}
+
+void
+output_datalen(const char *buf, int len)
+{
+	int remaining, copied;
+	
+	remaining = BUFSIZ - (nfrontp - netobuf);
+	while (len > 0) {
+		/* Free up enough space if the room is too low*/
+		if ((len > BUFSIZ ? BUFSIZ : len) > remaining) {
+			netflush();
+			remaining = BUFSIZ - (nfrontp - netobuf);
+		}
+
+		/* Copy out as much as will fit */
+		copied = remaining > len ? len : remaining;
+		memmove(nfrontp, buf, copied);
+		nfrontp += copied;
+		len -= copied;
+		remaining -= copied;
+		buf += copied;
+	}
+	return;
+}

libexec/telnetd/telnetd.c

@@ -644,34 +644,29 @@ getterminaltype(name)
 	static unsigned char sb[] =
 			{ IAC, SB, TELOPT_TSPEED, TELQUAL_SEND, IAC, SE };
 
-	bcopy(sb, nfrontp, sizeof sb);
-	nfrontp += sizeof sb;
+	output_datalen(sb, sizeof sb);
     }
     if (his_state_is_will(TELOPT_XDISPLOC)) {
 	static unsigned char sb[] =
 			{ IAC, SB, TELOPT_XDISPLOC, TELQUAL_SEND, IAC, SE };
 
-	bcopy(sb, nfrontp, sizeof sb);
-	nfrontp += sizeof sb;
+	output_datalen(sb, sizeof sb);
     }
     if (his_state_is_will(TELOPT_NEW_ENVIRON)) {
 	static unsigned char sb[] =
 			{ IAC, SB, TELOPT_NEW_ENVIRON, TELQUAL_SEND, IAC, SE };
 
-	bcopy(sb, nfrontp, sizeof sb);
-	nfrontp += sizeof sb;
+	output_datalen(sb, sizeof sb);
     }
     else if (his_state_is_will(TELOPT_OLD_ENVIRON)) {
 	static unsigned char sb[] =
 			{ IAC, SB, TELOPT_OLD_ENVIRON, TELQUAL_SEND, IAC, SE };
 
-	bcopy(sb, nfrontp, sizeof sb);
-	nfrontp += sizeof sb;
+	output_datalen(sb, sizeof sb);
     }
     if (his_state_is_will(TELOPT_TTYPE)) {
 
-	bcopy(ttytype_sbbuf, nfrontp, sizeof ttytype_sbbuf);
-	nfrontp += sizeof ttytype_sbbuf;
+	output_datalen(ttytype_sbbuf, sizeof ttytype_sbbuf);
     }
     if (his_state_is_will(TELOPT_TSPEED)) {
 	while (sequenceIs(tspeedsubopt, baseline))
@@ -748,8 +743,7 @@ _gettermname()
     if (his_state_is_wont(TELOPT_TTYPE))
 	return;
     settimer(baseline);
-    bcopy(ttytype_sbbuf, nfrontp, sizeof ttytype_sbbuf);
-    nfrontp += sizeof ttytype_sbbuf;
+    output_datalen(ttytype_sbbuf, sizeof ttytype_sbbuf);
     while (sequenceIs(ttypesubopt, baseline))
 	ttloop();
 }
@@ -915,8 +909,6 @@ telnet(f, p, host)
 	int if_fd;
 	struct stat statbuf;
 
-	void netflush();
-
 	/*
 	 * Initialize the slc mapping table.
 	 */
@@ -1000,9 +992,7 @@ telnet(f, p, host)
 	 * mode, which we do not want.
 	 */
 	if (his_want_state_is_will(TELOPT_ECHO)) {
-		DIAG(TD_OPTIONS,
-			{sprintf(nfrontp, "td: simulating recv\r\n");
-			 nfrontp += strlen(nfrontp);});
+		DIAG(TD_OPTIONS, output_data("td: simulating recv\r\n"));
 		willoption(TELOPT_ECHO);
 	}
 
@@ -1148,9 +1138,7 @@ telnet(f, p, host)
 	localstat();
 #endif	/* LINEMODE */
 
-	DIAG(TD_REPORT,
-		{sprintf(nfrontp, "td: Entering processing loop\r\n");
-		 nfrontp += strlen(nfrontp);});
+	DIAG(TD_REPORT, output_data("td: Entering processing loop\r\n"));
 
 	/*
 	 * Startup the login process on the slave side of the terminal
@@ -1278,8 +1266,7 @@ telnet(f, p, host)
 			netip = netibuf;
 		    }
 		    DIAG((TD_REPORT | TD_NETDATA),
-			    {sprintf(nfrontp, "td: netread %d chars\r\n", ncc);
-			     nfrontp += strlen(nfrontp);});
+			output_data("td: netread %d chars\r\n", ncc));
 		    DIAG(TD_NETDATA, printdata("nd", netip, ncc));
 		}
 
@@ -1326,8 +1313,7 @@ telnet(f, p, host)
 					 * royally if we send them urgent
 					 * mode data.
 					 */
-					*nfrontp++ = IAC;
-					*nfrontp++ = DM;
+					output_data("%c%c", IAC, DM);
 					neturg = nfrontp-1; /* off by one XXX */
 #endif
 				}
@@ -1338,13 +1324,11 @@ telnet(f, p, host)
 					    ptyibuf[0] & TIOCPKT_DOSTOP ? 1 : 0;
 					if (newflow != flowmode) {
 						flowmode = newflow;
-						(void) sprintf(nfrontp,
-							"%c%c%c%c%c%c",
+						output_data("%c%c%c%c%c%c",
 							IAC, SB, TELOPT_LFLOW,
 							flowmode ? LFLOW_ON
 								 : LFLOW_OFF,
 							IAC, SE);
-						nfrontp += 6;
 					}
 				}
 				pcc--;
@@ -1367,19 +1351,19 @@ telnet(f, p, host)
 				break;
 			c = *ptyip++ & 0377, pcc--;
 			if (c == IAC)
-				*nfrontp++ = c;
+				output_data("%c", c);
 #if	defined(CRAY2) && defined(UNICOS5)
 			else if (c == '\n' &&
 				     my_state_is_wont(TELOPT_BINARY) && newmap)
-				*nfrontp++ = '\r';
+				output_data("\r");
 #endif	/* defined(CRAY2) && defined(UNICOS5) */
-			*nfrontp++ = c;
+			output_data("%c", c);
 			if ((c == '\r') && (my_state_is_wont(TELOPT_BINARY))) {
 				if (pcc > 0 && ((*ptyip & 0377) == '\n')) {
-					*nfrontp++ = *ptyip++ & 0377;
+					output_data("%c", *ptyip++ & 0377);
 					pcc--;
 				} else
-					*nfrontp++ = '\0';
+					output_data("%c", '\0');
 			}
 		}
 #if	defined(CRAY2) && defined(UNICOS5)
@@ -1564,8 +1548,7 @@ recv_ayt()
 		return;
 	}
 #endif
-	(void) strcpy(nfrontp, "\r\n[Yes]\r\n");
-	nfrontp += 9;
+	output_data("\r\n[Yes]\r\n");
 }
 
 	void

libexec/telnetd/termstat.c

@@ -136,7 +136,6 @@ int	newmap = 1;	/* nonzero if \n maps to ^M^J */
 	void
 localstat()
 {
-	void netflush();
 	int need_will_echo = 0;
 
 #if	defined(CRAY2) && defined(UNICOS5)
@@ -279,10 +278,9 @@ localstat()
 # endif	/* KLUDGELINEMODE */
 			send_do(TELOPT_LINEMODE, 1);
 			/* send along edit modes */
-			(void) sprintf(nfrontp, "%c%c%c%c%c%c%c", IAC, SB,
+			output_data("%c%c%c%c%c%c%c", IAC, SB,
 				TELOPT_LINEMODE, LM_MODE, useeditmode,
 				IAC, SE);
-			nfrontp += 7;
 			editmode = useeditmode;
 # ifdef	KLUDGELINEMODE
 		}
@@ -308,10 +306,9 @@ localstat()
 			/*
 			 * Send along appropriate edit mode mask.
 			 */
-			(void) sprintf(nfrontp, "%c%c%c%c%c%c%c", IAC, SB,
+			output_data("%c%c%c%c%c%c%c", IAC, SB,
 				TELOPT_LINEMODE, LM_MODE, useeditmode,
 				IAC, SE);
-			nfrontp += 7;
 			editmode = useeditmode;
 		}
 
@@ -355,20 +352,18 @@ flowstat()
 	if (his_state_is_will(TELOPT_LFLOW)) {
 		if (tty_flowmode() != flowmode) {
 			flowmode = tty_flowmode();
-			(void) sprintf(nfrontp, "%c%c%c%c%c%c",
+			output_data("%c%c%c%c%c%c",
 					IAC, SB, TELOPT_LFLOW,
 					flowmode ? LFLOW_ON : LFLOW_OFF,
 					IAC, SE);
-			nfrontp += 6;
 		}
 		if (tty_restartany() != restartany) {
 			restartany = tty_restartany();
-			(void) sprintf(nfrontp, "%c%c%c%c%c%c",
+			output_data("%c%c%c%c%c%c",
 					IAC, SB, TELOPT_LFLOW,
 					restartany ? LFLOW_RESTART_ANY
 						   : LFLOW_RESTART_XON,
 					IAC, SE);
-			nfrontp += 6;
 		}
 	}
 }
@@ -385,7 +380,6 @@ flowstat()
 clientstat(code, parm1, parm2)
 	register int code, parm1, parm2;
 {
-	void netflush();
 
 	/*
 	 * Get a copy of terminal characteristics.
@@ -441,10 +435,9 @@ clientstat(code, parm1, parm2)
 					useeditmode |= MODE_SOFT_TAB;
 				if (tty_islitecho())
 					useeditmode |= MODE_LIT_ECHO;
-				(void) sprintf(nfrontp, "%c%c%c%c%c%c%c", IAC,
+				output_data("%c%c%c%c%c%c%c", IAC,
 					SB, TELOPT_LINEMODE, LM_MODE,
 							useeditmode, IAC, SE);
-				nfrontp += 7;
 				editmode = useeditmode;
 			}
 
@@ -500,11 +493,10 @@ clientstat(code, parm1, parm2)
 			set_termbuf();
 
  			if (!ack) {
- 				(void) sprintf(nfrontp, "%c%c%c%c%c%c%c", IAC,
+				output_data("%c%c%c%c%c%c%c", IAC,
 					SB, TELOPT_LINEMODE, LM_MODE,
  					useeditmode|MODE_ACK,
  					IAC, SE);
- 				nfrontp += 7;
  			}
 
 			editmode = useeditmode;

libexec/telnetd/utility.c

@@ -62,11 +62,9 @@ static const char rcsid[] =
     void
 ttloop()
 {
-    void netflush();
 
-    DIAG(TD_REPORT, {sprintf(nfrontp, "td: ttloop\r\n");
-		     nfrontp += strlen(nfrontp);});
-    if (nfrontp-nbackp) {
+    DIAG(TD_REPORT, output_data("td: ttloop\r\n"));
+    if (nfrontp - nbackp > 0) {
 	netflush();
     }
     ncc = read(net, netibuf, sizeof netibuf);
@@ -77,8 +75,7 @@ ttloop()
 	syslog(LOG_INFO, "ttloop:  peer died: %m");
 	exit(1);
     }
-    DIAG(TD_REPORT, {sprintf(nfrontp, "td: ttloop read %d chars\r\n", ncc);
-		     nfrontp += strlen(nfrontp);});
+    DIAG(TD_REPORT, output_data("td: ttloop read %d chars\r\n", ncc));
     netip = netibuf;
     telrcv();			/* state machine */
     if (ncc > 0) {
@@ -121,9 +118,8 @@ ptyflush()
 	int n;
 
 	if ((n = pfrontp - pbackp) > 0) {
-		DIAG((TD_REPORT | TD_PTYDATA),
-			{ sprintf(nfrontp, "td: ptyflush %d chars\r\n", n);
-			  nfrontp += strlen(nfrontp); });
+		DIAG(TD_REPORT | TD_PTYDATA,
+		    output_data("td: ptyflush %d chars\r\n", n));
 		DIAG(TD_PTYDATA, printdata("pd", pbackp, n));
 		n = write(pty, pbackp, n);
 	}
@@ -245,12 +241,13 @@ netflush()
     int n;
     extern int not42;
 
-    if ((n = nfrontp - nbackp) > 0) {
-	DIAG(TD_REPORT,
-	    { sprintf(nfrontp, "td: netflush %d chars\r\n", n);
-	      n += strlen(nfrontp);  /* get count first */
-	      nfrontp += strlen(nfrontp);  /* then move pointer */
-	    });
+    while ((n = nfrontp - nbackp) > 0) {
+#if 0
+	/* XXX This causes output_data() to recurse and die */
+	DIAG(TD_REPORT, {
+	    n += output_data("td: netflush %d chars\r\n", n);
+	});
+#endif
 	/*
 	 * if no urgent data, or if the other side appears to be an
 	 * old 4.2 client (and thus unable to survive TCP urgent data),
@@ -274,50 +271,24 @@ netflush()
 		n = send(net, nbackp, n, MSG_OOB);	/* URGENT data */
 	    }
 	}
-    }
-    if (n < 0) {
-	if (errno == EWOULDBLOCK || errno == EINTR)
-		return;
-	cleanup(0);
-    }
-    nbackp += n;
-    if (nbackp >= neturg) {
-	neturg = 0;
-    }
-    if (nbackp == nfrontp) {
-	nbackp = nfrontp = netobuf;
+	if (n == -1) {
+	    if (errno == EWOULDBLOCK || errno == EINTR)
+		continue;
+	    cleanup(0);
+	    /* NOTREACHED */
+	}
+	nbackp += n;
+	if (nbackp >= neturg) {
+	    neturg = 0;
+	}
+	if (nbackp == nfrontp) {
+	    nbackp = nfrontp = netobuf;
+	}
     }
     return;
 }  /* end of netflush */
 
 
-/*
- * writenet
- *
- * Just a handy little function to write a bit of raw data to the net.
- * It will force a transmit of the buffer if necessary
- *
- * arguments
- *    ptr - A pointer to a character string to write
- *    len - How many bytes to write
- */
-	void
-writenet(ptr, len)
-	register unsigned char *ptr;
-	register int len;
-{
-	/* flush buffer if no room for new data) */
-	if ((&netobuf[BUFSIZ] - nfrontp) < len) {
-		/* if this fails, don't worry, buffer is a little big */
-		netflush();
-	}
-
-	bcopy(ptr, nfrontp, len);
-	nfrontp += len;
-
-}  /* end of writenet */
-
-
 /*
  * miscellaneous functions doing a variety of little jobs follow ...
  */
@@ -513,12 +484,11 @@ printoption(fmt, option)
 	register int option;
 {
 	if (TELOPT_OK(option))
-		sprintf(nfrontp, "%s %s\r\n", fmt, TELOPT(option));
+		output_data("%s %s\r\n", fmt, TELOPT(option));
 	else if (TELCMD_OK(option))
-		sprintf(nfrontp, "%s %s\r\n", fmt, TELCMD(option));
+		output_data("%s %s\r\n", fmt, TELCMD(option));
 	else
-		sprintf(nfrontp, "%s %d\r\n", fmt, option);
-	nfrontp += strlen(nfrontp);
+		output_data("%s %d\r\n", fmt, option);
 	return;
 }
 
@@ -534,9 +504,8 @@ printsub(direction, pointer, length)
 		return;
 
 	if (direction) {
-	    sprintf(nfrontp, "td: %s suboption ",
+	    output_data("td: %s suboption ",
 					direction == '<' ? "recv" : "send");
-	    nfrontp += strlen(nfrontp);
 	    if (length >= 3) {
 		register int j;
 
@@ -544,232 +513,192 @@ printsub(direction, pointer, length)
 		j = pointer[length-1];
 
 		if (i != IAC || j != SE) {
-		    sprintf(nfrontp, "(terminated by ");
-		    nfrontp += strlen(nfrontp);
+		    output_data("(terminated by ");
 		    if (TELOPT_OK(i))
-			sprintf(nfrontp, "%s ", TELOPT(i));
+			output_data("%s ", TELOPT(i));
 		    else if (TELCMD_OK(i))
-			sprintf(nfrontp, "%s ", TELCMD(i));
+			output_data("%s ", TELCMD(i));
 		    else
-			sprintf(nfrontp, "%d ", i);
-		    nfrontp += strlen(nfrontp);
+			output_data("%d ", i);
 		    if (TELOPT_OK(j))
-			sprintf(nfrontp, "%s", TELOPT(j));
+			output_data("%s", TELOPT(j));
 		    else if (TELCMD_OK(j))
-			sprintf(nfrontp, "%s", TELCMD(j));
+			output_data("%s", TELCMD(j));
 		    else
-			sprintf(nfrontp, "%d", j);
-		    nfrontp += strlen(nfrontp);
-		    sprintf(nfrontp, ", not IAC SE!) ");
-		    nfrontp += strlen(nfrontp);
+			output_data("%d", j);
+		    output_data(", not IAC SE!) ");
 		}
 	    }
 	    length -= 2;
 	}
 	if (length < 1) {
-	    sprintf(nfrontp, "(Empty suboption??\?)");
-	    nfrontp += strlen(nfrontp);
+	    output_data("(Empty suboption??\?)");
 	    return;
 	}
 	switch (pointer[0]) {
 	case TELOPT_TTYPE:
-	    sprintf(nfrontp, "TERMINAL-TYPE ");
-	    nfrontp += strlen(nfrontp);
+	    output_data("TERMINAL-TYPE ");
 	    switch (pointer[1]) {
 	    case TELQUAL_IS:
-		sprintf(nfrontp, "IS \"%.*s\"", length-2, (char *)pointer+2);
+		output_data("IS \"%.*s\"", length-2, (char *)pointer+2);
 		break;
 	    case TELQUAL_SEND:
-		sprintf(nfrontp, "SEND");
+		output_data("SEND");
 		break;
 	    default:
-		sprintf(nfrontp,
+		output_data(
 				"- unknown qualifier %d (0x%x).",
 				pointer[1], pointer[1]);
 	    }
-	    nfrontp += strlen(nfrontp);
 	    break;
 	case TELOPT_TSPEED:
-	    sprintf(nfrontp, "TERMINAL-SPEED");
-	    nfrontp += strlen(nfrontp);
+	    output_data("TERMINAL-SPEED");
 	    if (length < 2) {
-		sprintf(nfrontp, " (empty suboption??\?)");
-		nfrontp += strlen(nfrontp);
+		output_data(" (empty suboption??\?)");
 		break;
 	    }
 	    switch (pointer[1]) {
 	    case TELQUAL_IS:
-		sprintf(nfrontp, " IS %.*s", length-2, (char *)pointer+2);
-		nfrontp += strlen(nfrontp);
+		output_data(" IS %.*s", length-2, (char *)pointer+2);
 		break;
 	    default:
 		if (pointer[1] == 1)
-		    sprintf(nfrontp, " SEND");
+		    output_data(" SEND");
 		else
-		    sprintf(nfrontp, " %d (unknown)", pointer[1]);
-		nfrontp += strlen(nfrontp);
+		    output_data(" %d (unknown)", pointer[1]);
 		for (i = 2; i < length; i++) {
-		    sprintf(nfrontp, " ?%d?", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" ?%d?", pointer[i]);
 		}
 		break;
 	    }
 	    break;
 
 	case TELOPT_LFLOW:
-	    sprintf(nfrontp, "TOGGLE-FLOW-CONTROL");
-	    nfrontp += strlen(nfrontp);
+	    output_data("TOGGLE-FLOW-CONTROL");
 	    if (length < 2) {
-		sprintf(nfrontp, " (empty suboption??\?)");
-		nfrontp += strlen(nfrontp);
+		output_data(" (empty suboption??\?)");
 		break;
 	    }
 	    switch (pointer[1]) {
 	    case LFLOW_OFF:
-		sprintf(nfrontp, " OFF"); break;
+		output_data(" OFF"); break;
 	    case LFLOW_ON:
-		sprintf(nfrontp, " ON"); break;
+		output_data(" ON"); break;
 	    case LFLOW_RESTART_ANY:
-		sprintf(nfrontp, " RESTART-ANY"); break;
+		output_data(" RESTART-ANY"); break;
 	    case LFLOW_RESTART_XON:
-		sprintf(nfrontp, " RESTART-XON"); break;
+		output_data(" RESTART-XON"); break;
 	    default:
-		sprintf(nfrontp, " %d (unknown)", pointer[1]);
+		output_data(" %d (unknown)", pointer[1]);
 	    }
-	    nfrontp += strlen(nfrontp);
 	    for (i = 2; i < length; i++) {
-		sprintf(nfrontp, " ?%d?", pointer[i]);
-		nfrontp += strlen(nfrontp);
+		output_data(" ?%d?", pointer[i]);
 	    }
 	    break;
 
 	case TELOPT_NAWS:
-	    sprintf(nfrontp, "NAWS");
-	    nfrontp += strlen(nfrontp);
+	    output_data("NAWS");
 	    if (length < 2) {
-		sprintf(nfrontp, " (empty suboption??\?)");
-		nfrontp += strlen(nfrontp);
+		output_data(" (empty suboption??\?)");
 		break;
 	    }
 	    if (length == 2) {
-		sprintf(nfrontp, " ?%d?", pointer[1]);
-		nfrontp += strlen(nfrontp);
+		output_data(" ?%d?", pointer[1]);
 		break;
 	    }
-	    sprintf(nfrontp, " %d %d (%d)",
+	    output_data(" %d %d (%d)",
 		pointer[1], pointer[2],
 		(int)((((unsigned int)pointer[1])<<8)|((unsigned int)pointer[2])));
-	    nfrontp += strlen(nfrontp);
 	    if (length == 4) {
-		sprintf(nfrontp, " ?%d?", pointer[3]);
-		nfrontp += strlen(nfrontp);
+		output_data(" ?%d?", pointer[3]);
 		break;
 	    }
-	    sprintf(nfrontp, " %d %d (%d)",
+	    output_data(" %d %d (%d)",
 		pointer[3], pointer[4],
 		(int)((((unsigned int)pointer[3])<<8)|((unsigned int)pointer[4])));
-	    nfrontp += strlen(nfrontp);
 	    for (i = 5; i < length; i++) {
-		sprintf(nfrontp, " ?%d?", pointer[i]);
-		nfrontp += strlen(nfrontp);
+		output_data(" ?%d?", pointer[i]);
 	    }
 	    break;
 
 	case TELOPT_LINEMODE:
-	    sprintf(nfrontp, "LINEMODE ");
-	    nfrontp += strlen(nfrontp);
+	    output_data("LINEMODE ");
 	    if (length < 2) {
-		sprintf(nfrontp, " (empty suboption??\?)");
-		nfrontp += strlen(nfrontp);
+		output_data(" (empty suboption??\?)");
 		break;
 	    }
 	    switch (pointer[1]) {
 	    case WILL:
-		sprintf(nfrontp, "WILL ");
+		output_data("WILL ");
 		goto common;
 	    case WONT:
-		sprintf(nfrontp, "WONT ");
+		output_data("WONT ");
 		goto common;
 	    case DO:
-		sprintf(nfrontp, "DO ");
+		output_data("DO ");
 		goto common;
 	    case DONT:
-		sprintf(nfrontp, "DONT ");
+		output_data("DONT ");
 	    common:
-		nfrontp += strlen(nfrontp);
 		if (length < 3) {
-		    sprintf(nfrontp, "(no option??\?)");
-		    nfrontp += strlen(nfrontp);
+		    output_data("(no option??\?)");
 		    break;
 		}
 		switch (pointer[2]) {
 		case LM_FORWARDMASK:
-		    sprintf(nfrontp, "Forward Mask");
-		    nfrontp += strlen(nfrontp);
+		    output_data("Forward Mask");
 		    for (i = 3; i < length; i++) {
-			sprintf(nfrontp, " %x", pointer[i]);
-			nfrontp += strlen(nfrontp);
+			output_data(" %x", pointer[i]);
 		    }
 		    break;
 		default:
-		    sprintf(nfrontp, "%d (unknown)", pointer[2]);
-		    nfrontp += strlen(nfrontp);
+		    output_data("%d (unknown)", pointer[2]);
 		    for (i = 3; i < length; i++) {
-			sprintf(nfrontp, " %d", pointer[i]);
-			nfrontp += strlen(nfrontp);
+			output_data(" %d", pointer[i]);
 		    }
 		    break;
 		}
 		break;
 
 	    case LM_SLC:
-		sprintf(nfrontp, "SLC");
-		nfrontp += strlen(nfrontp);
+		output_data("SLC");
 		for (i = 2; i < length - 2; i += 3) {
 		    if (SLC_NAME_OK(pointer[i+SLC_FUNC]))
-			sprintf(nfrontp, " %s", SLC_NAME(pointer[i+SLC_FUNC]));
+			output_data(" %s", SLC_NAME(pointer[i+SLC_FUNC]));
 		    else
-			sprintf(nfrontp, " %d", pointer[i+SLC_FUNC]);
-		    nfrontp += strlen(nfrontp);
+			output_data(" %d", pointer[i+SLC_FUNC]);
 		    switch (pointer[i+SLC_FLAGS]&SLC_LEVELBITS) {
 		    case SLC_NOSUPPORT:
-			sprintf(nfrontp, " NOSUPPORT"); break;
+			output_data(" NOSUPPORT"); break;
 		    case SLC_CANTCHANGE:
-			sprintf(nfrontp, " CANTCHANGE"); break;
+			output_data(" CANTCHANGE"); break;
 		    case SLC_VARIABLE:
-			sprintf(nfrontp, " VARIABLE"); break;
+			output_data(" VARIABLE"); break;
 		    case SLC_DEFAULT:
-			sprintf(nfrontp, " DEFAULT"); break;
+			output_data(" DEFAULT"); break;
 		    }
-		    nfrontp += strlen(nfrontp);
-		    sprintf(nfrontp, "%s%s%s",
+		    output_data("%s%s%s",
 			pointer[i+SLC_FLAGS]&SLC_ACK ? "|ACK" : "",
 			pointer[i+SLC_FLAGS]&SLC_FLUSHIN ? "|FLUSHIN" : "",
 			pointer[i+SLC_FLAGS]&SLC_FLUSHOUT ? "|FLUSHOUT" : "");
-		    nfrontp += strlen(nfrontp);
 		    if (pointer[i+SLC_FLAGS]& ~(SLC_ACK|SLC_FLUSHIN|
 						SLC_FLUSHOUT| SLC_LEVELBITS)) {
-			sprintf(nfrontp, "(0x%x)", pointer[i+SLC_FLAGS]);
-			nfrontp += strlen(nfrontp);
+			output_data("(0x%x)", pointer[i+SLC_FLAGS]);
 		    }
-		    sprintf(nfrontp, " %d;", pointer[i+SLC_VALUE]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" %d;", pointer[i+SLC_VALUE]);
 		    if ((pointer[i+SLC_VALUE] == IAC) &&
 			(pointer[i+SLC_VALUE+1] == IAC))
 				i++;
 		}
 		for (; i < length; i++) {
-		    sprintf(nfrontp, " ?%d?", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" ?%d?", pointer[i]);
 		}
 		break;
 
 	    case LM_MODE:
-		sprintf(nfrontp, "MODE ");
-		nfrontp += strlen(nfrontp);
+		output_data("MODE ");
 		if (length < 3) {
-		    sprintf(nfrontp, "(no mode??\?)");
-		    nfrontp += strlen(nfrontp);
+		    output_data("(no mode??\?)");
 		    break;
 		}
 		{
@@ -780,24 +709,19 @@ printsub(direction, pointer, length)
 			pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",
 			pointer[2]&MODE_LIT_ECHO ? "|LIT_ECHO" : "",
 			pointer[2]&MODE_ACK ? "|ACK" : "");
-		    sprintf(nfrontp, "%s", tbuf[1] ? &tbuf[1] : "0");
-		    nfrontp += strlen(nfrontp);
+		    output_data("%s", tbuf[1] ? &tbuf[1] : "0");
 		}
 		if (pointer[2]&~(MODE_EDIT|MODE_TRAPSIG|MODE_ACK)) {
-		    sprintf(nfrontp, " (0x%x)", pointer[2]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" (0x%x)", pointer[2]);
 		}
 		for (i = 3; i < length; i++) {
-		    sprintf(nfrontp, " ?0x%x?", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" ?0x%x?", pointer[i]);
 		}
 		break;
 	    default:
-		sprintf(nfrontp, "%d (unknown)", pointer[1]);
-		nfrontp += strlen(nfrontp);
+		output_data("%d (unknown)", pointer[1]);
 		for (i = 2; i < length; i++) {
-		    sprintf(nfrontp, " %d", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" %d", pointer[i]);
 		}
 	    }
 	    break;
@@ -806,24 +730,20 @@ printsub(direction, pointer, length)
 	    register char *cp;
 	    register int j, k;
 
-	    sprintf(nfrontp, "STATUS");
-	    nfrontp += strlen(nfrontp);
+	    output_data("STATUS");
 
 	    switch (pointer[1]) {
 	    default:
 		if (pointer[1] == TELQUAL_SEND)
-		    sprintf(nfrontp, " SEND");
+		    output_data(" SEND");
 		else
-		    sprintf(nfrontp, " %d (unknown)", pointer[1]);
-		nfrontp += strlen(nfrontp);
+		    output_data(" %d (unknown)", pointer[1]);
 		for (i = 2; i < length; i++) {
-		    sprintf(nfrontp, " ?%d?", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+		    output_data(" ?%d?", pointer[i]);
 		}
 		break;
 	    case TELQUAL_IS:
-		sprintf(nfrontp, " IS\r\n");
-		nfrontp += strlen(nfrontp);
+		output_data(" IS\r\n");
 
 		for (i = 2; i < length; i++) {
 		    switch(pointer[i]) {
@@ -834,18 +754,15 @@ printsub(direction, pointer, length)
 		    common2:
 			i++;
 			if (TELOPT_OK(pointer[i]))
-			    sprintf(nfrontp, " %s %s", cp, TELOPT(pointer[i]));
+			    output_data(" %s %s", cp, TELOPT(pointer[i]));
 			else
-			    sprintf(nfrontp, " %s %d", cp, pointer[i]);
-			nfrontp += strlen(nfrontp);
+			    output_data(" %s %d", cp, pointer[i]);
 
-			sprintf(nfrontp, "\r\n");
-			nfrontp += strlen(nfrontp);
+			output_data("\r\n");
 			break;
 
 		    case SB:
-			sprintf(nfrontp, " SB ");
-			nfrontp += strlen(nfrontp);
+			output_data(" SB ");
 			i++;
 			j = k = i;
 			while (j < length) {
@@ -861,20 +778,17 @@ printsub(direction, pointer, length)
 			}
 			printsub(0, &pointer[i], k - i);
 			if (i < length) {
-			    sprintf(nfrontp, " SE");
-			    nfrontp += strlen(nfrontp);
+			    output_data(" SE");
 			    i = j;
 			} else
 			    i = j - 1;
 
-			sprintf(nfrontp, "\r\n");
-			nfrontp += strlen(nfrontp);
+			output_data("\r\n");
 
 			break;
 
 		    default:
-			sprintf(nfrontp, " %d", pointer[i]);
-			nfrontp += strlen(nfrontp);
+			output_data(" %d", pointer[i]);
 			break;
 		    }
 		}
@@ -884,86 +798,77 @@ printsub(direction, pointer, length)
 	  }
 
 	case TELOPT_XDISPLOC:
-	    sprintf(nfrontp, "X-DISPLAY-LOCATION ");
-	    nfrontp += strlen(nfrontp);
+	    output_data("X-DISPLAY-LOCATION ");
 	    switch (pointer[1]) {
 	    case TELQUAL_IS:
-		sprintf(nfrontp, "IS \"%.*s\"", length-2, (char *)pointer+2);
+		output_data("IS \"%.*s\"", length-2, (char *)pointer+2);
 		break;
 	    case TELQUAL_SEND:
-		sprintf(nfrontp, "SEND");
+		output_data("SEND");
 		break;
 	    default:
-		sprintf(nfrontp, "- unknown qualifier %d (0x%x).",
+		output_data("- unknown qualifier %d (0x%x).",
 				pointer[1], pointer[1]);
 	    }
-	    nfrontp += strlen(nfrontp);
 	    break;
 
 	case TELOPT_NEW_ENVIRON:
-	    sprintf(nfrontp, "NEW-ENVIRON ");
+	    output_data("NEW-ENVIRON ");
 	    goto env_common1;
 	case TELOPT_OLD_ENVIRON:
-	    sprintf(nfrontp, "OLD-ENVIRON");
+	    output_data("OLD-ENVIRON");
 	env_common1:
-	    nfrontp += strlen(nfrontp);
 	    switch (pointer[1]) {
 	    case TELQUAL_IS:
-		sprintf(nfrontp, "IS ");
+		output_data("IS ");
 		goto env_common;
 	    case TELQUAL_SEND:
-		sprintf(nfrontp, "SEND ");
+		output_data("SEND ");
 		goto env_common;
 	    case TELQUAL_INFO:
-		sprintf(nfrontp, "INFO ");
+		output_data("INFO ");
 	    env_common:
-		nfrontp += strlen(nfrontp);
 		{
 		    register int noquote = 2;
 		    for (i = 2; i < length; i++ ) {
 			switch (pointer[i]) {
 			case NEW_ENV_VAR:
-			    sprintf(nfrontp, "\" VAR " + noquote);
-			    nfrontp += strlen(nfrontp);
+			    output_data("\" VAR " + noquote);
 			    noquote = 2;
 			    break;
 
 			case NEW_ENV_VALUE:
-			    sprintf(nfrontp, "\" VALUE " + noquote);
-			    nfrontp += strlen(nfrontp);
+			    output_data("\" VALUE " + noquote);
 			    noquote = 2;
 			    break;
 
 			case ENV_ESC:
-			    sprintf(nfrontp, "\" ESC " + noquote);
-			    nfrontp += strlen(nfrontp);
+			    output_data("\" ESC " + noquote);
 			    noquote = 2;
 			    break;
 
 			case ENV_USERVAR:
-			    sprintf(nfrontp, "\" USERVAR " + noquote);
-			    nfrontp += strlen(nfrontp);
+			    output_data("\" USERVAR " + noquote);
 			    noquote = 2;
 			    break;
 
 			default:
 			    if (isprint(pointer[i]) && pointer[i] != '"') {
 				if (noquote) {
-				    *nfrontp++ = '"';
+				    output_data("\"");
 				    noquote = 0;
 				}
-				*nfrontp++ = pointer[i];
+				output_data("%c", pointer[i]);
 			    } else {
-				sprintf(nfrontp, "\" %03o " + noquote,
+				output_data("\" %03o " + noquote,
 							pointer[i]);
-				nfrontp += strlen(nfrontp);
 				noquote = 2;
 			    }
 			    break;
 			}
 		    }
 		    if (!noquote)
-			*nfrontp++ = '"';
+			output_data("\"");
 		    break;
 		}
 	    }
@@ -971,83 +876,66 @@ printsub(direction, pointer, length)
 
 #if	defined(AUTHENTICATION)
 	case TELOPT_AUTHENTICATION:
-	    sprintf(nfrontp, "AUTHENTICATION");
-	    nfrontp += strlen(nfrontp);
+	    output_data("AUTHENTICATION");
 
 	    if (length < 2) {
-		sprintf(nfrontp, " (empty suboption??\?)");
-		nfrontp += strlen(nfrontp);
+		output_data(" (empty suboption??\?)");
 		break;
 	    }
 	    switch (pointer[1]) {
 	    case TELQUAL_REPLY:
 	    case TELQUAL_IS:
-		sprintf(nfrontp, " %s ", (pointer[1] == TELQUAL_IS) ?
+		output_data(" %s ", (pointer[1] == TELQUAL_IS) ?
 							"IS" : "REPLY");
-		nfrontp += strlen(nfrontp);
 		if (AUTHTYPE_NAME_OK(pointer[2]))
-		    sprintf(nfrontp, "%s ", AUTHTYPE_NAME(pointer[2]));
+		    output_data("%s ", AUTHTYPE_NAME(pointer[2]));
 		else
-		    sprintf(nfrontp, "%d ", pointer[2]);
-		nfrontp += strlen(nfrontp);
+		    output_data("%d ", pointer[2]);
 		if (length < 3) {
-		    sprintf(nfrontp, "(partial suboption??\?)");
-		    nfrontp += strlen(nfrontp);
+		    output_data("(partial suboption??\?)");
 		    break;
 		}
-		sprintf(nfrontp, "%s|%s",
+		output_data("%s|%s",
 			((pointer[3] & AUTH_WHO_MASK) == AUTH_WHO_CLIENT) ?
 			"CLIENT" : "SERVER",
 			((pointer[3] & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL) ?
 			"MUTUAL" : "ONE-WAY");
-		nfrontp += strlen(nfrontp);
 
     		{
 		    char buf[512];
 		    auth_printsub(&pointer[1], length - 1, buf, sizeof(buf));
-		    sprintf(nfrontp, "%s", buf);
+		    output_data("%s", buf);
 		}
-		nfrontp += strlen(nfrontp);
 		break;
 
 	    case TELQUAL_SEND:
 		i = 2;
-		sprintf(nfrontp, " SEND ");
-		nfrontp += strlen(nfrontp);
+		output_data(" SEND ");
 		while (i < length) {
 		    if (AUTHTYPE_NAME_OK(pointer[i]))
-			sprintf(nfrontp, "%s ", AUTHTYPE_NAME(pointer[i]));
+			output_data("%s ", AUTHTYPE_NAME(pointer[i]));
 		    else
-			sprintf(nfrontp, "%d ", pointer[i]);
-		    nfrontp += strlen(nfrontp);
+			output_data("%d ", pointer[i]);
 		    if (++i >= length) {
-			sprintf(nfrontp, "(partial suboption??\?)");
-			nfrontp += strlen(nfrontp);
+			output_data("(partial suboption??\?)");
 			break;
 		    }
-		    sprintf(nfrontp, "%s|%s ",
+		    output_data("%s|%s ",
 			((pointer[i] & AUTH_WHO_MASK) == AUTH_WHO_CLIENT) ?
 							"CLIENT" : "SERVER",
 			((pointer[i] & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL) ?
 							"MUTUAL" : "ONE-WAY");
-		    nfrontp += strlen(nfrontp);
 		    ++i;
 		}
 		break;
 
 	    case TELQUAL_NAME:
-		i = 2;
-		sprintf(nfrontp, " NAME \"");
-		nfrontp += strlen(nfrontp);
-		while (i < length)
-		    *nfrontp += pointer[i++];
-		*nfrontp += '"';
+		output_data(" NAME \"%.*s\"", length - 2, pointer + 2);
 		break;
 
 	    default:
 		    for (i = 2; i < length; i++) {
-			sprintf(nfrontp, " ?%d?", pointer[i]);
-			nfrontp += strlen(nfrontp);
+			output_data(" ?%d?", pointer[i]);
 		    }
 		    break;
 	    }
@@ -1057,18 +945,15 @@ printsub(direction, pointer, length)
 
 	default:
 	    if (TELOPT_OK(pointer[0]))
-	        sprintf(nfrontp, "%s (unknown)", TELOPT(pointer[0]));
+	        output_data("%s (unknown)", TELOPT(pointer[0]));
 	    else
-	        sprintf(nfrontp, "%d (unknown)", pointer[i]);
-	    nfrontp += strlen(nfrontp);
+	        output_data("%d (unknown)", pointer[i]);
 	    for (i = 1; i < length; i++) {
-		sprintf(nfrontp, " %d", pointer[i]);
-		nfrontp += strlen(nfrontp);
+		output_data(" %d", pointer[i]);
 	    }
 	    break;
 	}
-	sprintf(nfrontp, "\r\n");
-	nfrontp += strlen(nfrontp);
+	output_data("\r\n");
 }
 
 /*
@@ -1090,26 +975,22 @@ printdata(tag, ptr, cnt)
 		}
 
 		/* add a line of output */
-		sprintf(nfrontp, "%s: ", tag);
-		nfrontp += strlen(nfrontp);
+		output_data("%s: ", tag);
 		for (i = 0; i < 20 && cnt; i++) {
-			sprintf(nfrontp, "%02x", *ptr);
-			nfrontp += strlen(nfrontp);
+			output_data("%02x", *ptr);
 			if (isprint(*ptr)) {
 				xbuf[i] = *ptr;
 			} else {
 				xbuf[i] = '.';
 			}
 			if (i % 2) {
-				*nfrontp = ' ';
-				nfrontp++;
+				output_data(" ");
 			}
 			cnt--;
 			ptr++;
 		}
 		xbuf[i] = '\0';
-		sprintf(nfrontp, " %s\r\n", xbuf );
-		nfrontp += strlen(nfrontp);
+		output_data(" %s\r\n", xbuf );
 	}
 }
 #endif /* DIAGNOSTICS */

share/examples/cvsup/standard-supfile

@@ -51,7 +51,7 @@
 *default host=CHANGE_THIS.FreeBSD.org
 *default base=/usr
 *default prefix=/usr
-*default release=cvs tag=RELENG_4
+*default release=cvs tag=RELENG_4_3
 *default delete use-rel-suffix
 
 # If your network link is a T1 or faster, comment out the following line.

sys/conf/newvers.sh

@@ -36,7 +36,7 @@
 
 TYPE="FreeBSD"
 REVISION="4.3"
-BRANCH="RELEASE"
+BRANCH="RELEASE-p42"
 RELEASE="${REVISION}-${BRANCH}"
 VERSION="${TYPE} ${RELEASE}"
 

sys/i386/ibcs2/ibcs2_stat.c

@@ -82,6 +82,10 @@ cvt_statfs(sp, buf, len)
 {
 	struct ibcs2_statfs ssfs;
 
+	if (len < 0)
+		return (EINVAL);
+	else if (len > sizeof(ssfs))
+		len = sizeof(ssfs);
 	bzero(&ssfs, sizeof ssfs);
 	ssfs.f_fstyp = 0;
 	ssfs.f_bsize = sp->f_bsize;

sys/i386/isa/spigot.c

@@ -221,6 +221,8 @@ struct	spigot_info	*info;
 	if(!data) return(EINVAL);
 	switch(cmd){
 	case	SPIGOT_SETINT:
+		if (*(int *)data < 0 || *(int *)data > _SIG_MAXSIG)
+			return (EINVAL);
 		ss->p = p;
 		ss->signal_num = *((int *)data);
 		break;

sys/i386/linux/linprocfs/linprocfs_misc.c

@@ -85,7 +85,6 @@ linprocfs_domeminfo(curp, p, pfs, uio)
 	struct uio *uio;
 {
 	char *ps;
-	int xlen;
 	char psbuf[512];		/* XXX - conservative */
 	unsigned long memtotal;		/* total memory in bytes */
 	unsigned long memused;		/* used memory in bytes */
@@ -156,11 +155,7 @@ linprocfs_domeminfo(curp, p, pfs, uio)
 		B2K(memshared), B2K(buffers), B2K(cached),
 		B2K(swaptotal), B2K(swapfree));
 
-	xlen = ps - psbuf;
-	xlen -= uio->uio_offset;
-	ps = psbuf + uio->uio_offset;
-	xlen = imin(xlen, uio->uio_resid);
-	return (xlen <= 0 ? 0 : uiomove(ps, xlen, uio));
+	return (uiomove_frombuf(psbuf, ps - psbuf, uio));
 }
 
 int
@@ -171,7 +166,6 @@ linprocfs_docpuinfo(curp, p, pfs, uio)
 	struct uio *uio;
 {
 	char *ps;
-	int xlen;
 	char psbuf[512];		/* XXX - conservative */
 	int class;
         int i;
@@ -248,12 +242,7 @@ linprocfs_docpuinfo(curp, p, pfs, uio)
                         (tsc_freq + 4999) / 1000000,
                         ((tsc_freq + 4999) / 10000) % 100);
         }
-        
-	xlen = ps - psbuf;
-	xlen -= uio->uio_offset;
-	ps = psbuf + uio->uio_offset;
-	xlen = imin(xlen, uio->uio_resid);
-	return (xlen <= 0 ? 0 : uiomove(ps, xlen, uio));
+	return (uiomove_frombuf(psbuf, ps - psbuf, uio));
 }
 
 int
@@ -265,7 +254,6 @@ linprocfs_dostat(curp, p, pfs, uio)
 {
         char *ps;
 	char psbuf[512];
-	int xlen;
 
 	ps = psbuf;
 	ps += sprintf(ps,
@@ -287,11 +275,7 @@ linprocfs_dostat(curp, p, pfs, uio)
 		      cnt.v_intr,
 		      cnt.v_swtch,
 		      boottime.tv_sec);
-	xlen = ps - psbuf;
-	xlen -= uio->uio_offset;
-	ps = psbuf + uio->uio_offset;
-	xlen = imin(xlen, uio->uio_resid);
-	return (xlen <= 0 ? 0 : uiomove(ps, xlen, uio));
+	return (uiomove_frombuf(psbuf, ps - psbuf, uio));
 }
 
 int
@@ -302,7 +286,6 @@ linprocfs_douptime(curp, p, pfs, uio)
 	struct uio *uio;
 {
 	char *ps;
-	int xlen;
 	char psbuf[64];
 	struct timeval tv;
 
@@ -311,11 +294,7 @@ linprocfs_douptime(curp, p, pfs, uio)
 	ps += sprintf(ps, "%ld.%02ld %ld.%02ld\n",
 		      tv.tv_sec, tv.tv_usec / 10000,
 		      T2S(cp_time[CP_IDLE]), T2J(cp_time[CP_IDLE]) % 100);
-	xlen = ps - psbuf;
-	xlen -= uio->uio_offset;
-	ps = psbuf + uio->uio_offset;
-	xlen = imin(xlen, uio->uio_resid);
-	return (xlen <= 0 ? 0 : uiomove(ps, xlen, uio));
+	return (uiomove_frombuf(psbuf, ps - psbuf, uio));
 }
 
 int
@@ -332,10 +311,7 @@ linprocfs_doversion(curp, p, pfs, uio)
 	for (xlen = 0; ps[xlen] != '\n'; ++xlen)
 		/* nothing */ ;
 	++xlen;
-	xlen -= uio->uio_offset;
-	ps += uio->uio_offset;
-	xlen = imin(xlen, uio->uio_resid);
-	return (xlen <= 0 ? 0 : uiomove(ps, xlen, uio));
+	return (uiomove_frombuf(ps, xlen, uio));
 }
 
 int
@@ -346,7 +322,6 @@ linprocfs_doprocstat(curp, p, pfs, uio)
 	struct uio *uio;
 {
 	char *ps, psbuf[1024];
-	int xlen;
 
 	ps = psbuf;
 	ps += sprintf(ps, "%d", p->p_pid);
@@ -388,11 +363,7 @@ linprocfs_doprocstat(curp, p, pfs, uio)
 #undef PS_ADD
 	ps += sprintf(ps, "\n");
 	
-	xlen = ps - psbuf;
-	xlen -= uio->uio_offset;
-	ps = psbuf + uio->uio_offset;
-	xlen = imin(xlen, uio->uio_resid);
-	return (xlen <= 0 ? 0 : uiomove(ps, xlen, uio));
+	return (uiomove_frombuf(psbuf, ps - psbuf, uio));
 }
 
 /*
@@ -419,7 +390,7 @@ linprocfs_doprocstatus(curp, p, pfs, uio)
 {
 	char *ps, psbuf[1024];
 	char *state;
-	int i, xlen;
+	int i;
 
 	ps = psbuf;
 
@@ -490,9 +461,5 @@ linprocfs_doprocstatus(curp, p, pfs, uio)
 	PS_ADD(ps, "CapEff:\t%016x\n",	  0);
 #undef PS_ADD
 	
-	xlen = ps - psbuf;
-	xlen -= uio->uio_offset;
-	ps = psbuf + uio->uio_offset;
-	xlen = imin(xlen, uio->uio_resid);
-	return (xlen <= 0 ? 0 : uiomove(ps, xlen, uio));
+	return (uiomove_frombuf(psbuf, ps - psbuf, uio));
 }

sys/i386/linux/linprocfs/linprocfs_vnops.c

@@ -64,7 +64,6 @@
 #include <sys/pioctl.h>
 
 extern struct vnode *procfs_findtextvp __P((struct proc *));
-extern int	procfs_kmemaccess __P((struct proc *));
 
 static int	linprocfs_access __P((struct vop_access_args *));
 static int	linprocfs_badop __P((void));
@@ -143,8 +142,7 @@ linprocfs_open(ap)
 			return (EBUSY);
 
 		p1 = ap->a_p;
-		if (p_trespass(p1, p2) &&
-		    !procfs_kmemaccess(p1))
+		if (p_trespass(p1, p2))
 			return (EPERM);
 
 		if (ap->a_mode & FWRITE)
@@ -454,21 +452,6 @@ linprocfs_getattr(ap)
 	nanotime(&vap->va_ctime);
 	vap->va_atime = vap->va_mtime = vap->va_ctime;
 
-	/*
-	 * If the process has exercised some setuid or setgid
-	 * privilege, then rip away read/write permission so
-	 * that only root can gain access.
-	 */
-	switch (pfs->pfs_type) {
-	case Pmem:
-		/* Retain group kmem readablity. */
-		if (procp->p_flag & P_SUGID)
-			vap->va_mode &= ~(VREAD|VWRITE);
-		break;
-	default:
-		break;
-	}
-
 	/*
 	 * now do the object specific fields
 	 *
@@ -544,7 +527,6 @@ linprocfs_getattr(ap)
 			vap->va_uid = 0;
 		else
 			vap->va_uid = procp->p_ucred->cr_uid;
-		vap->va_gid = KMEM_GROUP;
 		break;
 
 	case Pprocstat:

sys/kern/kern_exec.c

@@ -29,7 +29,6 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
-#include <sys/signalvar.h>
 #include <sys/kernel.h>
 #include <sys/mount.h>
 #include <sys/filedesc.h>
@@ -39,9 +38,10 @@
 #include <sys/imgact.h>
 #include <sys/imgact_elf.h>
 #include <sys/wait.h>
-#include <sys/proc.h>
-#include <sys/pioctl.h>
 #include <sys/malloc.h>
+#include <sys/proc.h>
+#include <sys/signalvar.h>
+#include <sys/pioctl.h>
 #include <sys/namei.h>
 #include <sys/sysent.h>
 #include <sys/shm.h>
@@ -59,6 +59,7 @@
 #include <vm/vm_object.h>
 #include <vm/vm_pager.h>
 
+#include <sys/user.h>
 #include <machine/reg.h>
 
 MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments");
@@ -111,6 +112,15 @@ execve(p, uap)
 
 	imgp = &image_params;
 
+	/*
+	 * Lock the process and set the P_INEXEC flag to indicate that
+	 * it should be left alone until we're done here.  This is
+	 * necessary to avoid race conditions - e.g. in ptrace() -
+	 * that might allow a local user to illicitly obtain elevated
+	 * privileges.
+	 */
+	p->p_flag |= P_INEXEC;
+
 	/*
 	 * Initialize part of the common data
 	 */
@@ -246,6 +256,28 @@ interpret:
 		p->p_fd = tmp;
 	}
 
+	/*
+	 * For security and other reasons, signal handlers cannot
+	 * be shared after an exec. The new proces gets a copy of the old
+	 * handlers. In execsigs(), the new process wll have its signals
+	 * reset.
+	 */
+	if (p->p_procsig->ps_refcnt > 1) {
+		struct procsig *newprocsig;
+
+		MALLOC(newprocsig, struct procsig *, sizeof(struct procsig),
+		       M_SUBPROC, M_WAITOK);
+		bcopy(p->p_procsig, newprocsig, sizeof(*newprocsig));
+		p->p_procsig->ps_refcnt--;
+		p->p_procsig = newprocsig;
+		p->p_procsig->ps_refcnt = 1;
+		if (p->p_sigacts == &p->p_addr->u_sigacts)
+			panic("shared procsig but private sigacts?\n");
+
+		p->p_addr->u_sigacts = *p->p_sigacts;
+		p->p_sigacts = &p->p_addr->u_sigacts;
+	}
+
 	/* Stop profiling */
 	stopprofclock(p);
 
@@ -319,10 +351,12 @@ interpret:
 	VREF(ndp->ni_vp);
 	p->p_textvp = ndp->ni_vp;
 
-	/*
-	 * notify others that we exec'd
-	 */
+        /*
+         * Notify others that we exec'd, and clear the P_INEXEC flag
+         * as we're now a bona fide freshly-execed process.
+         */
 	KNOTE(&p->p_klist, NOTE_EXEC);
+	p->p_flag &= ~P_INEXEC;
 
 	/*
 	 * If tracing the process, trap to debugger so breakpoints
@@ -376,6 +410,8 @@ exec_fail_dealloc:
 		return (0);
 
 exec_fail:
+	/* we're done here, clear P_INEXEC */
+	p->p_flag &= ~P_INEXEC;
 	if (imgp->vmspace_destroyed) {
 		/* sorry, no more process anymore. exit gracefully */
 		exit1(p, W_EXITCODE(0, SIGABRT));

sys/kern/kern_subr.c

@@ -47,6 +47,7 @@
 #include <sys/lock.h>
 #include <sys/resourcevar.h>
 #include <sys/vnode.h>
+#include <machine/limits.h>
 
 #include <vm/vm.h>
 #include <vm/vm_page.h>
@@ -121,6 +122,28 @@ uiomove(cp, n, uio)
 	return (error);
 }
 
+/*
+ * Wrapper for uiomove() that validates the arguments against a known-good
+ * kernel buffer.  Currently, uiomove accepts a signed (n) argument, which
+ * is almost definitely a bad thing, so we catch that here as well.  We
+ * return a runtime failure, but it might be desirable to generate a runtime
+ * assertion failure instead.
+ */
+int
+uiomove_frombuf(void *buf, int buflen, struct uio *uio)
+{
+	unsigned int offset, n;
+
+	if (uio->uio_offset < 0 || uio->uio_resid < 0 ||
+	    (offset = uio->uio_offset) != uio->uio_offset)
+		return (EINVAL);
+	if (buflen <= 0 || offset >= buflen)
+		return (0);
+	if ((n = buflen - offset) > INT_MAX)
+		return (EINVAL);
+	return (uiomove((char *)buf + offset, n, uio));
+}
+
 int
 uiomoveco(cp, n, uio, obj)
 	caddr_t cp;

sys/kern/sys_generic.c

@@ -231,7 +231,7 @@ readv(p, uap)
 	register struct filedesc *fdp = p->p_fd;
 	struct uio auio;
 	register struct iovec *iov;
-	struct iovec *needfree;
+	struct iovec *needfree = NULL;
 	struct iovec aiov[UIO_SMALLIOV];
 	long i, cnt, error = 0;
 	u_int iovlen;
@@ -245,14 +245,14 @@ readv(p, uap)
 	/* note: can't use iovlen until iovcnt is validated */
 	iovlen = uap->iovcnt * sizeof (struct iovec);
 	if (uap->iovcnt > UIO_SMALLIOV) {
-		if (uap->iovcnt > UIO_MAXIOV)
-			return (EINVAL);
+		if (uap->iovcnt > UIO_MAXIOV) {
+			error = EINVAL;
+			goto done;
+		}
 		MALLOC(iov, struct iovec *, iovlen, M_IOV, M_WAITOK);
 		needfree = iov;
-	} else {
+	} else
 		iov = aiov;
-		needfree = NULL;
-	}
 	auio.uio_iov = iov;
 	auio.uio_iovcnt = uap->iovcnt;
 	auio.uio_rw = UIO_READ;

sys/kern/sys_process.c

@@ -220,6 +220,10 @@ ptrace(curp, uap)
 	if (!PRISON_CHECK(curp, p))
 		return (ESRCH);
 
+	/* Can't trace a process that's currently exec'ing. */ 
+	if ((p->p_flag & P_INEXEC) != 0)
+		return EAGAIN;
+
 	/*
 	 * Permissions check
 	 */
@@ -330,7 +334,8 @@ ptrace(curp, uap)
 	case PT_STEP:
 	case PT_CONTINUE:
 	case PT_DETACH:
-		if ((uap->req != PT_STEP) && ((unsigned)uap->data >= NSIG))
+		/* Zero means do not send any signal */
+		if (uap->data < 0 || uap->data > _SIG_MAXSIG)
 			return EINVAL;
 
 		PHOLD(p);

sys/kern/sysv_sem.c

@@ -672,7 +672,7 @@ found:
 struct semop_args {
 	int	semid;
 	struct	sembuf *sops;
-	int	nsops;
+	u_int	nsops;
 };
 #endif
 
@@ -682,7 +682,7 @@ semop(p, uap)
 	register struct semop_args *uap;
 {
 	int semid = uap->semid;
-	int nsops = uap->nsops;
+	u_int nsops = uap->nsops;
 	struct sembuf sops[MAX_SOPS];
 	register struct semid_ds *semaptr;
 	register struct sembuf *sopptr;
@@ -692,7 +692,7 @@ semop(p, uap)
 	int do_wakeup, do_undos;
 
 #ifdef SEM_DEBUG
-	printf("call to semop(%d, 0x%x, %d)\n", semid, sops, nsops);
+	printf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops);
 #endif
 
 	if (!jail_sysvipc_allowed && p->p_prison != NULL)
@@ -718,14 +718,14 @@ semop(p, uap)
 
 	if (nsops > MAX_SOPS) {
 #ifdef SEM_DEBUG
-		printf("too many sops (max=%d, nsops=%d)\n", MAX_SOPS, nsops);
+		printf("too many sops (max=%d, nsops=%u)\n", MAX_SOPS, nsops);
 #endif
 		return(E2BIG);
 	}
 
 	if ((eval = copyin(uap->sops, &sops, nsops * sizeof(sops[0]))) != 0) {
 #ifdef SEM_DEBUG
-		printf("eval = %d from copyin(%08x, %08x, %d)\n", eval,
+		printf("eval = %d from copyin(%08x, %08x, %u)\n", eval,
 		    uap->sops, &sops, nsops * sizeof(sops[0]));
 #endif
 		return(eval);

sys/kern/vfs_syscalls.c

@@ -678,6 +678,8 @@ fstatfs(p, uap)
 	if ((error = getvnode(p->p_fd, SCARG(uap, fd), &fp)) != 0)
 		return (error);
 	mp = ((struct vnode *)fp->f_data)->v_mount;
+	if (mp == NULL)
+		return (EBADF);
 	sp = &mp->mnt_stat;
 	error = VFS_STATFS(mp, sp, p);
 	if (error)

sys/miscfs/procfs/procfs.h

@@ -88,8 +88,6 @@ struct pfsnode {
 	 ((cnp)->cn_namelen == (len) && \
 	  (bcmp((s), (cnp)->cn_nameptr, (len)) == 0))
 
-#define KMEM_GROUP 2
-
 #define PROCFS_FILENO(pid, type) \
 	(((type) < Pproc) ? \
 			((type) + 2) : \
@@ -99,7 +97,7 @@ struct pfsnode {
      ((((p1)->p_cred->pc_ucred->cr_uid == (p2)->p_cred->p_ruid) && \
        ((p1)->p_cred->p_ruid == (p2)->p_cred->p_ruid) && \
        ((p1)->p_cred->p_svuid == (p2)->p_cred->p_ruid) && \
-       ((p2)->p_flag & P_SUGID) == 0) || \
+       ((p2)->p_flag & (P_SUGID|P_INEXEC)) == 0) || \
       (suser_xxx((p1)->p_cred->pc_ucred, (p1), PRISON_ROOT) == 0))
 
 /*
@@ -148,9 +146,6 @@ int procfs_dotype __P((struct proc *, struct proc *, struct pfsnode *pfsp, struc
 int procfs_docmdline __P((struct proc *, struct proc *, struct pfsnode *pfsp, struct uio *uio));
 int procfs_dorlimit __P((struct proc *, struct proc *, struct pfsnode *pfsp, struct uio *uio));
 
-/* Return 1 if process has special kernel digging privileges */
-int procfs_kmemaccess __P((struct proc *));
-
 /* functions to check whether or not files should be displayed */
 int procfs_validfile __P((struct proc *));
 int procfs_validfpregs __P((struct proc *));

sys/miscfs/procfs/procfs_ctl.c

@@ -110,6 +110,9 @@ procfs_control(curp, p, op)
 {
 	int error;
 
+	/* Can't trace a process that's currently exec'ing. */ 
+	if ((p->p_flag & P_INEXEC) != 0)
+		return EAGAIN;
 	/*
 	 * Authorization check: rely on normal debugging protection, except
 	 * allow processes to disengage debugging on a process onto which

sys/miscfs/procfs/procfs_dbregs.c

@@ -59,27 +59,17 @@ procfs_dodbregs(curp, p, pfs, uio)
 {
 	int error;
 	struct dbreg r;
-	char *kv;
-	int kl;
 
+	/* Can't trace a process that's currently exec'ing. */ 
+	if ((p->p_flag & P_INEXEC) != 0)
+		return EAGAIN;
 	if (!CHECKIO(curp, p) || p_trespass(curp, p))
 		return (EPERM);
-	kl = sizeof(r);
-	kv = (char *) &r;
-
-	kv += uio->uio_offset;
-	kl -= uio->uio_offset;
-	if (kl > uio->uio_resid)
-		kl = uio->uio_resid;
 
 	PHOLD(p);
-
-	if (kl < 0)
-		error = EINVAL;
-	else
-		error = procfs_read_dbregs(p, &r);
+	error = procfs_read_dbregs(p, &r);
 	if (error == 0)
-		error = uiomove(kv, kl, uio);
+		error = uiomove_frombuf(&r, sizeof(r), uio);
 	if (error == 0 && uio->uio_rw == UIO_WRITE) {
 		if (p->p_stat != SSTOP)
 			error = EBUSY;

sys/miscfs/procfs/procfs_fpregs.c

@@ -56,27 +56,18 @@ procfs_dofpregs(curp, p, pfs, uio)
 {
 	int error;
 	struct fpreg r;
-	char *kv;
-	int kl;
 
+	/* Can't trace a process that's currently exec'ing. */ 
+	if ((p->p_flag & P_INEXEC) != 0)
+		return EAGAIN;
 	if (!CHECKIO(curp, p) || p_trespass(curp, p))
 		return EPERM;
-	kl = sizeof(r);
-	kv = (char *) &r;
-
-	kv += uio->uio_offset;
-	kl -= uio->uio_offset;
-	if (kl > uio->uio_resid)
-		kl = uio->uio_resid;
 
 	PHOLD(p);
 
-	if (kl < 0)
-		error = EINVAL;
-	else
-		error = procfs_read_fpregs(p, &r);
+	error = procfs_read_fpregs(p, &r);
 	if (error == 0)
-		error = uiomove(kv, kl, uio);
+		error = uiomove_frombuf(&r, sizeof(r), uio);
 	if (error == 0 && uio->uio_rw == UIO_WRITE) {
 		if (p->p_stat != SSTOP)
 			error = EBUSY;

sys/miscfs/procfs/procfs_mem.c

@@ -244,21 +244,10 @@ procfs_domem(curp, p, pfs, uio)
 	if (uio->uio_resid == 0)
 		return (0);
 
- 	/*
- 	 * XXX
- 	 * We need to check for KMEM_GROUP because ps is sgid kmem;
- 	 * not allowing it here causes ps to not work properly.  Arguably,
- 	 * this is a bug with what ps does.  We only need to do this
- 	 * for Pmem nodes, and only if it's reading.  This is still not
- 	 * good, as it may still be possible to grab illicit data if
- 	 * a process somehow gets to be KMEM_GROUP.  Note that this also
- 	 * means that KMEM_GROUP can't change without editing procfs.h!
- 	 * All in all, quite yucky.
- 	 */
- 
- 	if ((!CHECKIO(curp, p) || p_trespass(curp, p)) &&
-	    !(uio->uio_rw == UIO_READ &&
-	      procfs_kmemaccess(curp)))
+	/* Can't trace a process that's currently exec'ing. */ 
+	if ((p->p_flag & P_INEXEC) != 0)
+		return EAGAIN;
+ 	if (!CHECKIO(curp, p) || p_trespass(curp, p))
  		return EPERM;
 
 	return (procfs_rwmem(curp, p, uio));
@@ -296,21 +285,3 @@ procfs_findtextvp(p)
 
 	return (p->p_textvp);
 }
-
-int procfs_kmemaccess(curp)
-	struct proc *curp;
-{
-	int i;
-	struct ucred *cred;
-
-	cred = curp->p_ucred;
-	if (suser(curp))
-		return 1;
-
-	/* XXX: Why isn't this done with file-perms ??? */
-	for (i = 0; i < cred->cr_ngroups; i++)
-		if (cred->cr_groups[i] == KMEM_GROUP)	
-			return 1;
-	
-	return 0;
-}

sys/miscfs/procfs/procfs_regs.c

@@ -57,27 +57,18 @@ procfs_doregs(curp, p, pfs, uio)
 {
 	int error;
 	struct reg r;
-	char *kv;
-	int kl;
 
+	/* Can't trace a process that's currently exec'ing. */ 
+	if ((p->p_flag & P_INEXEC) != 0)
+		return EAGAIN;
 	if (!CHECKIO(curp, p) || p_trespass(curp, p))
 		return EPERM;
-	kl = sizeof(r);
-	kv = (char *) &r;
-
-	kv += uio->uio_offset;
-	kl -= uio->uio_offset;
-	if (kl > uio->uio_resid)
-		kl = uio->uio_resid;
 
 	PHOLD(p);
 
-	if (kl < 0)
-		error = EINVAL;
-	else
-		error = procfs_read_regs(p, &r);
+	error = procfs_read_regs(p, &r);
 	if (error == 0)
-		error = uiomove(kv, kl, uio);
+		error = uiomove_frombuf(&r, sizeof(r), uio);
 	if (error == 0 && uio->uio_rw == UIO_WRITE) {
 		if (p->p_stat != SSTOP)
 			error = EBUSY;

sys/miscfs/procfs/procfs_rlimit.c

@@ -64,7 +64,6 @@ procfs_dorlimit(curp, p, pfs, uio)
 {
 	char *ps;
 	int i;
-	int xlen;
 	int error;
 	char psbuf[512];		/* XXX - conservative */
 
@@ -109,20 +108,7 @@ procfs_dorlimit(curp, p, pfs, uio)
 		}
 	}
 
-	/*
-	 * This logic is rather tasty - but its from procfs_status.c, so
-	 * I guess I'll use it here.
-	 */
-
-	xlen = ps - psbuf;
-	xlen -= uio->uio_offset;
-	ps = psbuf + uio->uio_offset;
-	xlen = imin(xlen, uio->uio_resid);
-	if (xlen <= 0)
-		error = 0;
-	else
-		error = uiomove(ps, xlen, uio);
-
+	error = uiomove_frombuf(psbuf, ps - psbuf, uio);
 	return (error);
 }
 

sys/miscfs/procfs/procfs_status.c

@@ -166,15 +166,7 @@ procfs_dostatus(curp, p, pfs, uio)
 	ps += snprintf(ps, psbuf + sizeof(psbuf) - ps, "\n");
 	DOCHECK();
 
-	xlen = ps - psbuf;
-	xlen -= uio->uio_offset;
-	ps = psbuf + uio->uio_offset;
-	xlen = imin(xlen, uio->uio_resid);
-	if (xlen <= 0)
-		error = 0;
-	else
-		error = uiomove(ps, xlen, uio);
-
+	error = uiomove_frombuf(psbuf, ps - psbuf, uio);
 	return (error);
 
 bailout:
@@ -211,7 +203,9 @@ procfs_docmdline(curp, p, pfs, uio)
 	 */
 
 	if (p->p_args &&
-	    (ps_argsopen || (CHECKIO(curp, p) && !p_trespass(curp, p)))) {
+	    (ps_argsopen || (CHECKIO(curp, p) &&
+			     (p->p_flag & P_INEXEC) == 0 &&
+			     !p_trespass(curp, p)))) {
 		bp = p->p_args->ar_args;
 		buflen = p->p_args->ar_length;
 		buf = 0;
@@ -244,13 +238,7 @@ procfs_docmdline(curp, p, pfs, uio)
 		buflen = ps - buf;
 	}
 
-	buflen -= uio->uio_offset;
-	ps = bp + uio->uio_offset;
-	xlen = min(buflen, uio->uio_resid);
-	if (xlen <= 0)
-		error = 0;
-	else
-		error = uiomove(ps, xlen, uio);
+	error = uiomove_frombuf(bp, buflen, uio);
 	if (buf)
 		FREE(buf, M_TEMP);
 	return (error);

sys/miscfs/procfs/procfs_vnops.c

@@ -148,8 +148,10 @@ procfs_open(ap)
 			return (EBUSY);
 
 		p1 = ap->a_p;
-		if ((!CHECKIO(p1, p2) || p_trespass(p1, p2)) &&
-		    !procfs_kmemaccess(p1))
+		/* Can't trace a process that's currently exec'ing. */ 
+		if ((p2->p_flag & P_INEXEC) != 0)
+			return EAGAIN;
+		if (!CHECKIO(p1, p2) || p_trespass(p1, p2))
 			return (EPERM);
 
 		if (ap->a_mode & FWRITE)
@@ -240,6 +242,9 @@ procfs_ioctl(ap)
 		return ENOTTY;
 	}
 
+	/* Can't trace a process that's currently exec'ing. */ 
+	if ((procp->p_flag & P_INEXEC) != 0)
+		return EAGAIN;
 	if (!CHECKIO(p, procp) || p_trespass(p, procp))
 		return EPERM;
 
@@ -477,16 +482,12 @@ procfs_getattr(ap)
 	case Pregs:
 	case Pfpregs:
 	case Pdbregs:
+	case Pmem:
 		if (procp->p_flag & P_SUGID)
 			vap->va_mode &= ~((VREAD|VWRITE)|
 					  ((VREAD|VWRITE)>>3)|
 					  ((VREAD|VWRITE)>>6));
 		break;
-	case Pmem:
-		/* Retain group kmem readablity. */
-		if (procp->p_flag & P_SUGID)
-			vap->va_mode &= ~(VREAD|VWRITE);
-		break;
 	default:
 		break;
 	}
@@ -556,7 +557,6 @@ procfs_getattr(ap)
 			vap->va_uid = 0;
 		else
 			vap->va_uid = procp->p_ucred->cr_uid;
-		vap->va_gid = KMEM_GROUP;
 		break;
 
 	case Pregs:

sys/net/zlib.c

@@ -776,7 +776,7 @@ int deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
         windowBits = -windowBits;
     }
     if (memLevel < 1 || memLevel > MAX_MEM_LEVEL || method != Z_DEFLATED ||
-        windowBits < 8 || windowBits > 15 || level < 0 || level > 9 ||
+        windowBits < 9 || windowBits > 15 || level < 0 || level > 9 ||
 	strategy < 0 || strategy > Z_HUFFMAN_ONLY) {
         return Z_STREAM_ERROR;
     }
@@ -3864,10 +3864,11 @@ int r;
                              &s->sub.trees.tb, z);
       if (t != Z_OK)
       {
-        ZFREE(z, s->sub.trees.blens);
         r = t;
-        if (r == Z_DATA_ERROR)
+        if (r == Z_DATA_ERROR) {
+          ZFREE(z, s->sub.trees.blens);
           s->mode = BADB;
+        }
         LEAVE
       }
       s->sub.trees.index = 0;
@@ -3932,11 +3933,12 @@ int r;
 #endif
         t = inflate_trees_dynamic(257 + (t & 0x1f), 1 + ((t >> 5) & 0x1f),
                                   s->sub.trees.blens, &bl, &bd, &tl, &td, z);
-        ZFREE(z, s->sub.trees.blens);
         if (t != Z_OK)
         {
-          if (t == (uInt)Z_DATA_ERROR)
+          if (t == (uInt)Z_DATA_ERROR) {
+            ZFREE(z, s->sub.trees.blens);
             s->mode = BADB;
+          }
           r = t;
           LEAVE
         }
@@ -3949,6 +3951,11 @@ int r;
           r = Z_MEM_ERROR;
           LEAVE
         }
+	/*
+	 * this ZFREE must occur *BEFORE* we mess with sub.decode, because
+	 * sub.trees is union'd with sub.decode.
+	 */
+        ZFREE(z, s->sub.trees.blens);
         s->sub.decode.codes = c;
         s->sub.decode.tl = tl;
         s->sub.decode.td = td;

sys/netinet/if_ether.c

@@ -787,12 +787,20 @@ arplookup(addr, create, proxy)
 	else if (rt->rt_gateway->sa_family != AF_LINK)
 		why = "gateway route is not ours";
 
-	if (why && create) {
-		log(LOG_DEBUG, "arplookup %s failed: %s\n",
-		    inet_ntoa(sin.sin_addr), why);
-		return 0;
-	} else if (why) {
-		return 0;
+	if (why) {
+		if (create)
+			log(LOG_DEBUG, "arplookup %s failed: %s\n",
+			    inet_ntoa(sin.sin_addr), why);
+
+		/* If there are no references to this route, purge it */
+		if (rt->rt_refcnt <= 0 &&
+		    (rt->rt_flags & RTF_WASCLONED) == RTF_WASCLONED) {
+			rtrequest(RTM_DELETE,
+					(struct sockaddr *)rt_key(rt),
+					rt->rt_gateway, rt_mask(rt),
+					rt->rt_flags, 0);
+		}
+		return (0);
 	}
 	return ((struct llinfo_arp *)rt->rt_llinfo);
 }

sys/netinet/in_var.h

@@ -94,20 +94,11 @@ extern	u_char	inetctlerrmap[];
 	/* struct in_addr addr; */ \
 	/* struct ifnet *ifp; */ \
 { \
-	register struct in_ifaddr *ia; \
+	struct in_ifaddr *ia; \
 \
-	for (ia = in_ifaddrhead.tqh_first; \
-	    ia != NULL && ((ia->ia_ifp->if_flags & IFF_POINTOPOINT)? \
-		IA_DSTSIN(ia):IA_SIN(ia))->sin_addr.s_addr != (addr).s_addr; \
-	    ia = ia->ia_link.tqe_next) \
-		 continue; \
-	if (ia == NULL) \
-	    for (ia = in_ifaddrhead.tqh_first; \
-		ia != NULL; \
-		ia = ia->ia_link.tqe_next) \
-		    if (ia->ia_ifp->if_flags & IFF_POINTOPOINT && \
-			IA_SIN(ia)->sin_addr.s_addr == (addr).s_addr) \
-			    break; \
+	TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) \
+		if (IA_SIN(ia)->sin_addr.s_addr == (addr).s_addr) \
+			break; \
 	(ifp) = (ia == NULL) ? NULL : ia->ia_ifp; \
 }
 
@@ -119,9 +110,9 @@ extern	u_char	inetctlerrmap[];
 	/* struct ifnet *ifp; */ \
 	/* struct in_ifaddr *ia; */ \
 { \
-	for ((ia) = in_ifaddrhead.tqh_first; \
+	for ((ia) = TAILQ_FIRST(&in_ifaddrhead); \
 	    (ia) != NULL && (ia)->ia_ifp != (ifp); \
-	    (ia) = (ia)->ia_link.tqe_next) \
+	    (ia) = TAILQ_NEXT((ia), ia_link)) \
 		continue; \
 }
 #endif
@@ -182,10 +173,9 @@ struct in_multistep {
 	/* struct ifnet *ifp; */ \
 	/* struct in_multi *inm; */ \
 do { \
-	register struct ifmultiaddr *ifma; \
+	struct ifmultiaddr *ifma; \
 \
-	for (ifma = (ifp)->if_multiaddrs.lh_first; ifma; \
-	     ifma = ifma->ifma_link.le_next) { \
+	LIST_FOREACH(ifma, &((ifp)->if_multiaddrs), ifma_link) { \
 		if (ifma->ifma_addr->sa_family == AF_INET \
 		    && ((struct sockaddr_in *)ifma->ifma_addr)->sin_addr.s_addr == \
 		    (addr).s_addr) \
@@ -206,14 +196,14 @@ do { \
 	/* struct in_multi *inm; */ \
 do { \
 	if (((inm) = (step).i_inm) != NULL) \
-		(step).i_inm = (step).i_inm->inm_link.le_next; \
+		(step).i_inm = LIST_NEXT((step).i_inm, inm_link); \
 } while(0)
 
 #define IN_FIRST_MULTI(step, inm) \
 	/* struct in_multistep step; */ \
 	/* struct in_multi *inm; */ \
 do { \
-	(step).i_inm = in_multihead.lh_first; \
+	(step).i_inm = LIST_FIRST(&in_multihead); \
 	IN_NEXT_MULTI((step), (inm)); \
 } while(0)
 

sys/netinet/ip_input.c

@@ -122,6 +122,12 @@ SYSCTL_INT(_net_inet_ip, IPCTL_KEEPFAITH, keepfaith, CTLFLAG_RW,
 	&ip_keepfaith,	0,
 	"Enable packet capture for FAITH IPv4->IPv6 translater daemon");
 
+static int	ip_nfragpackets = 0;
+static int	ip_maxfragpackets;	/* initialized in ip_init() */
+SYSCTL_INT(_net_inet_ip, OID_AUTO, maxfragpackets, CTLFLAG_RW,
+	&ip_maxfragpackets, 0,
+	"Maximum number of IPv4 fragment reassembly queue entries");
+
 /*
  * XXX - Setting ip_checkinterface mostly implements the receive side of
  * the Strong ES model described in RFC 1122, but since the routing table
@@ -248,7 +254,8 @@ ip_init()
 	for (i = 0; i < IPREASS_NHASH; i++)
 	    ipq[i].next = ipq[i].prev = &ipq[i];
 
-	maxnipq = nmbclusters/4;
+	maxnipq = nmbclusters / 4;
+	ip_maxfragpackets = nmbclusters / 4;
 
 	ip_id = time_second & 0xffff;
 	ipintrq.ifq_maxlen = ipqmaxlen;
@@ -861,6 +868,15 @@ ip_reass(m, fp, where)
 	 * If first fragment to arrive, create a reassembly queue.
 	 */
 	if (fp == 0) {
+		/*
+		 * Enforce upper bound on number of fragmented packets
+		 * for which we attempt reassembly;
+		 * If maxfrag is 0, never accept fragments.
+		 * If maxfrag is -1, accept all fragments without limitation.
+		 */
+		if ((ip_maxfragpackets >= 0) && (ip_nfragpackets >= ip_maxfragpackets))
+			goto dropfrag;
+		ip_nfragpackets++;
 		if ((t = m_get(M_DONTWAIT, MT_FTABLE)) == NULL)
 			goto dropfrag;
 		fp = mtod(t, struct ipq *);
@@ -1009,6 +1025,7 @@ inserted:
 	remque(fp);
 	nipq--;
 	(void) m_free(dtom(fp));
+	ip_nfragpackets--;
 	m->m_len += (IP_VHL_HL(ip->ip_vhl) << 2);
 	m->m_data -= (IP_VHL_HL(ip->ip_vhl) << 2);
 	/* some debugging cruft by sklower, below, will go away soon */
@@ -1049,6 +1066,7 @@ ip_freef(fp)
 	}
 	remque(fp);
 	(void) m_free(dtom(fp));
+	ip_nfragpackets--;
 	nipq--;
 }
 
@@ -1077,6 +1095,20 @@ ip_slowtimo()
 			}
 		}
 	}
+	/*
+	 * If we are over the maximum number of fragments
+	 * (due to the limit being lowered), drain off
+	 * enough to get down to the new limit.
+	 */
+	for (i = 0; i < IPREASS_NHASH; i++) {
+		if (ip_maxfragpackets >= 0) {
+			while ((ip_nfragpackets > ip_maxfragpackets) &&
+				(ipq[i].next != &ipq[i])) {
+				ipstat.ips_fragdropped++;
+				ip_freef(ipq[i].next);
+			}
+		}
+	}
 	ipflow_slowtimo();
 	splx(s);
 }

sys/netinet6/frag6.c

@@ -81,6 +81,8 @@ frag6_init()
 {
 	struct timeval tv;
 
+	ip6_maxfragpackets = nmbclusters / 4;
+
 	/*
 	 * in many cases, random() here does NOT return random number
 	 * as initialization during bootstrap time occur in fixed order.

sys/netinet6/in6_proto.c

@@ -286,7 +286,7 @@ int	ip6_sendredirects = IPV6_SENDREDIRECTS;
 int	ip6_defhlim = IPV6_DEFHLIM;
 int	ip6_defmcasthlim = IPV6_DEFAULT_MULTICAST_HOPS;
 int	ip6_accept_rtadv = 0;	/* "IPV6FORWARDING ? 0 : 1" is dangerous */
-int	ip6_maxfragpackets = 200;
+int	ip6_maxfragpackets;	/* initialized in frag6.c:frag6_init() */
 int	ip6_log_interval = 5;
 int	ip6_hdrnestlimit = 50;	/* appropriate? */
 int	ip6_dad_count = 1;	/* DupAddrDetectionTransmits */

sys/nfs/nfs_vfsops.c

@@ -807,6 +807,8 @@ nfs_mount(mp, path, data, ndp, p)
 		nfs_decode_args(nmp, &args);
 		return (0);
 	}
+	if (args.fhsize < 0 || args.fhsize > NFSX_V3FHMAX)
+		return (EINVAL);
 	error = copyin((caddr_t)args.fh, (caddr_t)nfh, args.fhsize);
 	if (error)
 		return (error);

sys/sys/proc.h

@@ -291,6 +291,7 @@ struct	proc {
 #define	P_JAILED	0x1000000 /* Process is in jail */
 #define	P_OLDMASK	0x2000000 /* need to restore mask before pause */
 #define	P_ALTSTACK	0x4000000 /* have alternate signal stack */
+#define	P_INEXEC	0x8000000 /* Process is in execve(). */
 
 /*
  * MOVE TO ucred.h?

sys/sys/uio.h

@@ -77,6 +77,7 @@ struct uio {
 struct vm_object;
 
 int	uiomove __P((caddr_t, int, struct uio *));
+int	uiomove_frombuf __P((void *buf, int buflen, struct uio *uio));
 int	uiomoveco __P((caddr_t, int, struct uio *, struct vm_object *));
 int	uioread __P((int, struct uio *, struct vm_object *, int *));
 

usr.bin/keyinfo/Makefile

@@ -1,4 +1,5 @@
 #	@(#)Makefile	5.5 (Berkeley) 7/1/90
+# $FreeBSD$
 
 BINMODE=4555
 

usr.bin/tip/tip/Makefile

@@ -1,4 +1,5 @@
 #	@(#)Makefile	8.1 (Berkeley) 6/6/93
+# $FreeBSD$
 #
 # Files are:
 #	/etc/remote		remote host description file
@@ -21,6 +22,7 @@ MAN1=	tip.1
 MAN5=	modems.5
 SRCS=	acu.c acutab.c cmds.c cmdtab.c cu.c hunt.c log.c partab.c \
 	remote.c tip.c tipout.c value.c vars.c
+INSTALLFLAGS+= -fschg
 
 BINDIR?=	/usr/bin
 BINOWN=		uucp

usr.sbin/adduser/rmuser.perl

@@ -32,6 +32,8 @@
 #
 # $FreeBSD$
 
+use Fcntl;
+
 sub LOCK_SH {0x01;}
 sub LOCK_EX {0x02;}
 sub LOCK_NB {0x04;}
@@ -42,7 +44,7 @@ $ENV{"PATH"} = "/bin:/sbin:/usr/bin:/usr/sbin";
 umask(022);
 $whoami = $0;
 $passwd_file = "/etc/master.passwd";
-$new_passwd_file = "${passwd_file}.new.$$";
+$passwd_tmp = "/etc/ptmp";
 $group_file = "/etc/group";
 $new_group_file = "${group_file}.new.$$";
 $mail_dir = "/var/mail";
@@ -311,10 +313,10 @@ sub update_passwd_file {
 
     print STDERR "Updating password file,";
     seek(MASTER_PW, 0, 0);
-    open(NEW_PW, ">$new_passwd_file") ||
-	die "\n${whoami}: Error: Couldn't open file ${new_passwd_file}:\n $!\n";
-    chmod(0600, $new_passwd_file) ||
-	print STDERR "\n${whoami}: Warning: couldn't set mode of $new_passwd_file to 0600 ($!)\n\tcontinuing, but please check mode of /etc/master.passwd!\n";
+
+    sysopen(NEW_PW, $passwd_tmp, O_RDWR|O_CREAT|O_EXCL, 0600) ||
+	die "\n${whoami}: Error: Couldn't open file ${passwd_tmp}:\n $!\n";
+
     $skipped = 0;
     while (<MASTER_PW>) {
 	if (not /^\Q$login_name:/io) {
@@ -329,8 +331,8 @@ sub update_passwd_file {
 
     if ($skipped == 0) {
 	print STDERR "\n${whoami}: Whoops! Didn't find ${login_name}'s entry second time around!\n";
-	unlink($new_passwd_file) ||
-	    print STDERR "\n${whoami}: Warning: couldn't unlink $new_passwd_file ($!)\n\tPlease investigate, as this file should not be left in the filesystem\n";
+	unlink($passwd_tmp) ||
+	    print STDERR "\n${whoami}: Warning: couldn't unlink $passwd_tmp ($!)\n\tPlease investigate, as this file should not be left in the filesystem\n";
 	&unlockpw;
 	exit 1;
     }
@@ -339,7 +341,7 @@ sub update_passwd_file {
     # Run pwd_mkdb to install the updated password files and databases
 
     print STDERR " updating databases,";
-    system('/usr/sbin/pwd_mkdb', '-p', ${new_passwd_file});
+    system('/usr/sbin/pwd_mkdb', '-p', ${passwd_tmp});
     print STDERR " done.\n";
 
     close(MASTER_PW);		# Not useful anymore

usr.sbin/lpr/common_source/displayq.c

@@ -73,8 +73,8 @@ static const char rcsid[] =
 extern uid_t	uid, euid;
 
 static int	col;		/* column on screen */
-static char	current[40];	/* current file being printed */
-static char	file[132];	/* print file name */
+static char	current[MAXNAMLEN+1];	/* current file being printed */
+static char	file[MAXNAMLEN+1];	/* print file name */
 static int	first;		/* first file in ``files'' column? */
 static int	garbage;	/* # of garbage cf files */
 static int	lflag;		/* long output option */
@@ -97,7 +97,7 @@ displayq(pp, format)
 {
 	register struct jobqueue *q;
 	register int i, nitems, fd, ret;
-	register char	*cp;
+	char *cp, *endp;
 	struct jobqueue **queue;
 	struct stat statb;
 	FILE *fp;
@@ -158,8 +158,11 @@ displayq(pp, format)
 		else {
 			/* get daemon pid */
 			cp = current;
-			while ((i = getc(fp)) != EOF && i != '\n')
-				*cp++ = i;
+			endp = cp + sizeof(current) - 1;
+			while ((i = getc(fp)) != EOF && i != '\n') {
+				if (cp < endp)
+					*cp++ = i;
+			}
 			*cp = '\0';
 			i = atoi(current);
 			if (i <= 0) {
@@ -174,8 +177,11 @@ displayq(pp, format)
 			} else {
 				/* read current file name */
 				cp = current;
-				while ((i = getc(fp)) != EOF && i != '\n')
-					*cp++ = i;
+				endp = cp + sizeof(current) - 1;
+				while ((i = getc(fp)) != EOF && i != '\n') {
+					if (cp < endp)
+						*cp++ = i;
+				}
 				*cp = '\0';
 				/*
 				 * Print the status file.

usr.sbin/pkg_install/lib/pen.c

@@ -106,7 +106,7 @@ make_playpen(char *pen, size_t sz)
 	cleanup(0);
 	errx(2, __FUNCTION__ ": can't mktemp '%s'", pen);
     }
-    if (chmod(pen, 0755) == FAIL) {
+    if (chmod(pen, 0700) == FAIL) {
 	cleanup(0);
 	errx(2, __FUNCTION__ ": can't mkdir '%s'", pen);
     }

usr.sbin/pw/pwupd.c

@@ -174,7 +174,7 @@ pw_update(struct passwd * pwd, char const * user, int mode)
 			 */
 			if (pwd != NULL)
 				fmtpwentry(pwbuf, pwd, PWF_MASTER);
-			rc = fileupdate(getpwpath(_MASTERPASSWD), 0644, pwbuf, pfx, l, mode);
+			rc = fileupdate(getpwpath(_MASTERPASSWD), 0600, pwbuf, pfx, l, mode);
 			if (rc == 0) {
 #ifdef HAVE_PWDB_U
 				if (mode == UPD_DELETE || isrename)