snprintf audit. debug inet_neta() on non-continuous masks (like 0.255.0.255),

more pickier string manipulation.  deraadt ok

3 files changed, 76 insertions, 36 deletions

diff --git a/lib/libc/net/inet_net_ntop.c b/lib/libc/net/inet_net_ntop.c
index f5cb588d107..18eea6bb6d2 100644
--- a/lib/libc/net/inet_net_ntop.c
+++ b/lib/libc/net/inet_net_ntop.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: inet_net_ntop.c,v 1.2 2002/02/17 19:42:23 millert Exp $	*/
+/*	$OpenBSD: inet_net_ntop.c,v 1.3 2002/08/19 03:01:54 itojun Exp $	*/
 
 /*
  * Copyright (c) 1996 by Internet Software Consortium.
@@ -21,7 +21,7 @@
 #if 0
 static const char rcsid[] = "$From: inet_net_ntop.c,v 8.2 1996/08/08 06:54:44 vixie Exp $";
 #else
-static const char rcsid[] = "$OpenBSD: inet_net_ntop.c,v 1.2 2002/02/17 19:42:23 millert Exp $";
+static const char rcsid[] = "$OpenBSD: inet_net_ntop.c,v 1.3 2002/08/19 03:01:54 itojun Exp $";
 #endif
 #endif
 
@@ -88,13 +88,19 @@ inet_net_ntop_ipv4(src, bits, dst, size)
 	char *t;
 	u_int m;
 	int b;
+	char *ep;
+	int advance;
+
+	ep = dst + size;
+	if (ep <= dst)
+		goto emsgsize;
 
 	if (bits < 0 || bits > 32) {
 		errno = EINVAL;
 		return (NULL);
 	}
 	if (bits == 0) {
-		if (size < sizeof "0")
+		if (ep - dst < sizeof "0")
 			goto emsgsize;
 		*dst++ = '0';
 		*dst = '\0';
@@ -102,34 +108,43 @@ inet_net_ntop_ipv4(src, bits, dst, size)
 
 	/* Format whole octets. */
 	for (b = bits / 8; b > 0; b--) {
-		if (size < sizeof "255.")
+		if (ep - dst < sizeof "255.")
+			goto emsgsize;
+		advance = snprintf(dst, ep - dst, "%u", *src++);
+		if (advance <= 0 || advance >= ep - dst)
 			goto emsgsize;
-		t = dst;
-		dst += sprintf(dst, "%u", *src++);
+		dst += advance;
 		if (b > 1) {
+			if (dst + 1 >= ep)
+				goto emsgsize;
 			*dst++ = '.';
 			*dst = '\0';
 		}
-		size -= (size_t)(dst - t);
 	}
 
 	/* Format partial octet. */
 	b = bits % 8;
 	if (b > 0) {
-		if (size < sizeof ".255")
+		if (ep - dst < sizeof ".255")
 			goto emsgsize;
-		t = dst;
 		if (dst != odst)
+			if (dst + 1 >= ep)
+				goto emsgsize;
 			*dst++ = '.';
 		m = ((1 << b) - 1) << (8 - b);
-		dst += sprintf(dst, "%u", *src & m);
-		size -= (size_t)(dst - t);
+		advance = snprintf(dst, ep - dst, "%u", *src & m);
+		if (advance <= 0 || advance >= ep - dst)
+			goto emsgsize;
+		dst += advance;
 	}
 
 	/* Format CIDR /width. */
-	if (size < sizeof "/32")
+	if (ep - dst < sizeof "/32")
+		goto emsgsize;
+	advance = snprintf(dst, ep - dst, "/%u", bits);
+	if (advance <= 0 || advance >= ep - dst)
 		goto emsgsize;
-	dst += sprintf(dst, "/%u", bits);
+	dst += advance;
 	return (odst);
 
  emsgsize:
diff --git a/lib/libc/net/inet_neta.c b/lib/libc/net/inet_neta.c
index 881a328ab02..6960bcd0b5b 100644
--- a/lib/libc/net/inet_neta.c
+++ b/lib/libc/net/inet_neta.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: inet_neta.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $	*/
+/*	$OpenBSD: inet_neta.c,v 1.4 2002/08/19 03:01:54 itojun Exp $	*/
 
 /*
  * Copyright (c) 1996 by Internet Software Consortium.
@@ -19,9 +19,9 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 #if 0
-static const char rcsid[] = "$Id: inet_neta.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $";
+static const char rcsid[] = "$Id: inet_neta.c,v 1.4 2002/08/19 03:01:54 itojun Exp $";
 #else
-static const char rcsid[] = "$OpenBSD: inet_neta.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $";
+static const char rcsid[] = "$OpenBSD: inet_neta.c,v 1.4 2002/08/19 03:01:54 itojun Exp $";
 #endif
 #endif
 
@@ -52,29 +52,37 @@ inet_neta(src, dst, size)
 	size_t size;
 {
 	char *odst = dst;
-	char *tp;
+	char *ep;
+	int advance;
 
+	if (src == 0x00000000) {
+		if (size < sizeof "0.0.0.0")
+			goto emsgsize;
+		strlcpy(dst, "0.0.0.0", size);
+		return dst;
+	}
+	ep = dst + size;
+	if (ep <= dst)
+		goto emsgsize;
 	while (src & 0xffffffff) {
 		u_char b = (src & 0xff000000) >> 24;
 
 		src <<= 8;
-		if (b) {
-			if (size < sizeof "255.")
+		if (b || src) {
+			if (ep - dst < sizeof "255.")
+				goto emsgsize;
+			advance = snprintf(dst, ep - dst, "%u", b);
+			if (advance <= 0 || advance >= ep - dst)
 				goto emsgsize;
-			tp = dst;
-			dst += sprintf(dst, "%u", b);
+			dst += advance;
 			if (src != 0L) {
+				if (dst + 1 >= ep)
+					goto emsgsize;
 				*dst++ = '.';
 				*dst = '\0';
 			}
-			size -= (size_t)(dst - tp);
 		}
 	}
-	if (dst == odst) {
-		if (size < sizeof "0.0.0.0")
-			goto emsgsize;
-		strlcpy(dst, "0.0.0.0", size);
-	}
 	return (odst);
 
  emsgsize:
diff --git a/lib/libc/net/inet_ntop.c b/lib/libc/net/inet_ntop.c
index 212c0396b27..5293e80fc0b 100644
--- a/lib/libc/net/inet_ntop.c
+++ b/lib/libc/net/inet_ntop.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: inet_ntop.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $	*/
+/*	$OpenBSD: inet_ntop.c,v 1.4 2002/08/19 03:01:54 itojun Exp $	*/
 
 /* Copyright (c) 1996 by Internet Software Consortium.
  *
@@ -20,7 +20,7 @@
 #if 0
 static char rcsid[] = "$From: inet_ntop.c,v 8.7 1996/08/05 08:41:18 vixie Exp $";
 #else
-static char rcsid[] = "$OpenBSD: inet_ntop.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: inet_ntop.c,v 1.4 2002/08/19 03:01:54 itojun Exp $";
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -116,10 +116,12 @@ inet_ntop6(src, dst, size)
 	 * Keep this in mind if you think this function should have been coded
 	 * to use pointer overlays.  All the world's not a VAX.
 	 */
-	char tmp[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"], *tp;
+	char tmp[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"];
+	char *tp, *ep;
 	struct { int base, len; } best, cur;
 	u_int words[IN6ADDRSZ / INT16SZ];
 	int i;
+	int advance;
 
 	/*
 	 * Preprocess:
@@ -156,30 +158,45 @@ inet_ntop6(src, dst, size)
 	 * Format the result.
 	 */
 	tp = tmp;
-	for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
+	ep = tmp + sizeof(tmp);
+	for (i = 0; i < (IN6ADDRSZ / INT16SZ) && tp < ep; i++) {
 		/* Are we inside the best run of 0x00's? */
 		if (best.base != -1 && i >= best.base &&
 		    i < (best.base + best.len)) {
-			if (i == best.base)
+			if (i == best.base) {
+				if (tp + 1 >= ep)
+					return (NULL);
 				*tp++ = ':';
+			}
 			continue;
 		}
 		/* Are we following an initial run of 0x00s or any real hex? */
-		if (i != 0)
+		if (i != 0) {
+			if (tp + 1 >= ep)
+				return (NULL);
 			*tp++ = ':';
+		}
 		/* Is this address an encapsulated IPv4? */
 		if (i == 6 && best.base == 0 &&
 		    (best.len == 6 || (best.len == 5 && words[5] == 0xffff))) {
-			if (!inet_ntop4(src+12, tp, sizeof tmp - (tp - tmp)))
+			if (!inet_ntop4(src+12, tp, (size_t)(ep - tp)))
 				return (NULL);
 			tp += strlen(tp);
 			break;
 		}
-		tp += sprintf(tp, "%x", words[i]);
+		advance = snprintf(tp, ep - tp, "%x", words[i]);
+		if (advance <= 0 || advance >= ep - tp)
+			return (NULL);
+		tp += advance;
 	}
 	/* Was it a trailing run of 0x00's? */
-	if (best.base != -1 && (best.base + best.len) == (IN6ADDRSZ / INT16SZ))
+	if (best.base != -1 && (best.base + best.len) == (IN6ADDRSZ / INT16SZ)) {
+		if (tp + 1 >= ep)
+			return (NULL);
 		*tp++ = ':';
+	}
+	if (tp + 1 >= ep)
+		return (NULL);
 	*tp++ = '\0';
 
 	/*