added my Recipes

This commit is contained in:
2024-07-11 14:16:35 +02:00
parent 38bc4f53ac
commit 09b621d929
7118 changed files with 525762 additions and 3 deletions

View File

@@ -0,0 +1,457 @@
From af89f36fbeb5f6a078b349eed8fc4ad6fbfdf5d1 Mon Sep 17 00:00:00 2001
From: Khem Raj <raj.khem@gmail.com>
Date: Mon, 16 Jan 2023 15:26:12 -0800
Subject: [PATCH] Drop using register keyword
Its gone since c++17
Fixes
error: ISO C++17 does not allow 'register' storage class specifier [-Wregister]
| register char c;
| ^~~~~~~~~
Upstream-Status: Pending
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
telnet/commands.cc | 14 +++++++-------
telnet/defines.h | 1 +
telnet/sys_bsd.cc | 2 +-
telnet/telnet.cc | 18 +++++++++---------
telnet/terminal.cc | 4 ++--
telnet/tn3270.cc | 4 ++--
telnet/tn3270.o | Bin 4008 -> 4008 bytes
telnet/utilities.cc | 6 +++---
telnetd/setproctitle.c | 6 +++---
telnetd/slc.c | 4 ++--
telnetd/state.c | 12 ++++++------
telnetd/sys_term.c | 4 ++--
telnetd/telnetd.c | 4 ++--
telnetd/termstat.c | 4 ++--
telnetd/utility.c | 16 ++++++++--------
15 files changed, 50 insertions(+), 49 deletions(-)
--- a/telnet/commands.cc
+++ b/telnet/commands.cc
@@ -192,8 +192,8 @@ static int margc;
static const char *margv[20];
static void makeargv(void) {
- register char *cp, *cp2, c;
- register const char **argp = margv;
+ char *cp, *cp2, c;
+ const char **argp = margv;
margc = 0;
cp = line;
@@ -204,7 +204,7 @@ static void makeargv(void) {
cp++;
}
while ((c = *cp)!=0) {
- register int inquote = 0;
+ int inquote = 0;
while (isspace(c))
c = *++cp;
if (c == '\0')
@@ -281,7 +281,7 @@ static const char *control(cc_t c)
* was to assign "c" to an unsigned int variable...
* Arggg....
*/
- register unsigned int uic = (unsigned int)c;
+ unsigned int uic = (unsigned int)c;
if (uic == 0x7f)
return ("^?");
@@ -479,7 +479,7 @@ int send_tncmd(int (*func)(int, int), co
long opt;
if (isprefix(name, "help") || isprefix(name, "?")) {
- register int col, len;
+ int col, len;
printf("Usage: send %s <option>\n", cmd);
printf("Valid options are:\n\t");
@@ -2212,8 +2212,8 @@ static unsigned long sourceroute(char *a
static char lsr[44];
char *cp, *cp2, *lsrp, *lsrep;
struct in_addr sin_addr;
- register struct hostent *host = 0;
- register char c;
+ struct hostent *host = 0;
+ char c;
/*
* Verify the arguments, and make sure we have
--- a/telnet/defines.h
+++ b/telnet/defines.h
@@ -52,3 +52,4 @@
#define CONTROL(x) ((x)&0x1f) /* CTRL(x) is not portable */
#define MODE_OUT8 0x8000 /* binary mode sans -opost */
+
--- a/telnet/sys_bsd.cc
+++ b/telnet/sys_bsd.cc
@@ -285,7 +285,7 @@ void sys_telnet_init(void) {
int process_rings(int netin, int netout, int netex, int ttyin, int ttyout,
int poll /* If 0, then block until something to do */)
{
- register int c, maxfd;
+ int c, maxfd;
/* One wants to be a bit careful about setting returnValue
* to one, since a one implies we did some useful work,
* and therefore probably won't be called to block next
--- a/telnet/telnet.cc
+++ b/telnet/telnet.cc
@@ -864,7 +864,7 @@ struct spc {
static int slc_mode = SLC_EXPORT;
void slc_init(void) {
- register struct spc *spcp;
+ struct spc *spcp;
localchars = 1;
for (spcp = spc_data; spcp < &spc_data[NSLC+1]; spcp++) {
@@ -944,7 +944,7 @@ void slc_import(int def) {
}
void slc_export(void) {
- register struct spc *spcp;
+ struct spc *spcp;
TerminalDefaultChars();
@@ -966,8 +966,8 @@ void slc_export(void) {
}
void slc(unsigned char *cp, int len) {
- register struct spc *spcp;
- register int func,level;
+ struct spc *spcp;
+ int func,level;
slc_start_reply();
@@ -1032,7 +1032,7 @@ void slc(unsigned char *cp, int len) {
}
void slc_check(void) {
- register struct spc *spcp;
+ struct spc *spcp;
slc_start_reply();
for (spcp = &spc_data[1]; spcp < &spc_data[NSLC+1]; spcp++) {
@@ -1080,7 +1080,7 @@ void slc_add_reply(int func, int flags,
}
void slc_end_reply(void) {
- register int len;
+ int len;
*slc_replyp++ = IAC;
*slc_replyp++ = SE;
@@ -1200,7 +1200,7 @@ void env_opt_add(const char *ep) {
tp = opt_replyp + (vp ? strlen(vp) * 2 : 0) + strlen(ep) * 2 + 6;
if (tp > opt_replyend)
{
- register int len;
+ int len;
len = ((tp - opt_reply) + OPT_REPLY_SIZE - 1) & ~(OPT_REPLY_SIZE - 1);
opt_replyend = opt_reply + len;
opt_reply = (unsigned char *)realloc(opt_reply, len);
@@ -1236,7 +1236,7 @@ void env_opt_add(const char *ep) {
}
void env_opt_end(int emptyok) {
- register int len;
+ int len;
len = opt_replyp - opt_reply + 2;
if (emptyok || len > 6) {
@@ -1874,7 +1874,7 @@ static unsigned char *nextitem(unsigned
static void netclear(void) {
#if 0 /* XXX */
- register char *thisitem, *next;
+ char *thisitem, *next;
char *good;
#define wewant(p) ((nfrontp > p) && (*p == IAC) && \
(p[1] != EC) && (p[1] != EL))
--- a/telnet/terminal.cc
+++ b/telnet/terminal.cc
@@ -569,8 +569,8 @@ struct termspeeds {
};
void TerminalSpeeds(long *ispeed, long *ospeed) {
- register struct termspeeds *tp;
- register long in, out;
+ struct termspeeds *tp;
+ long in, out;
out = cfgetospeed(&old_tc);
in = cfgetispeed(&old_tc);
--- a/telnet/tn3270.cc
+++ b/telnet/tn3270.cc
@@ -103,7 +103,7 @@ void init_3270(void) {
* done: is this the last of a logical block
*/
int DataToNetwork(char *buffer, int count, int done) {
- register int loop, c;
+ int loop, c;
int origCount;
origCount = count;
@@ -179,7 +179,7 @@ void outputPurge(void) {
* count: how much to send
*/
int DataToTerminal(char *buffer, int count) {
- register int c;
+ int c;
int origCount;
origCount = count;
--- a/telnet/utilities.cc
+++ b/telnet/utilities.cc
@@ -252,7 +252,7 @@ void optionstatus(void) {
/* pointer: where suboption data sits */
/* length: length of suboption data */
void printsub(int direction, unsigned char *pointer, int length) {
- register int i = 0;
+ int i = 0;
extern int want_status_response;
@@ -262,7 +262,7 @@ void printsub(int direction, unsigned ch
fprintf(NetTrace, "%s IAC SB ",
(direction == '<')? "RCVD":"SENT");
if (length >= 3) {
- register int j;
+ int j;
i = pointer[length-2];
j = pointer[length-1];
@@ -577,7 +577,7 @@ void printsub(int direction, unsigned ch
fprintf(NetTrace, "INFO ");
env_common:
{
- register int noquote = 2;
+ int noquote = 2;
for (i = 2; i < length; i++ ) {
switch (pointer[i]) {
case ENV_VAR:
--- a/telnetd/setproctitle.c
+++ b/telnetd/setproctitle.c
@@ -76,7 +76,7 @@ static char Argv0[128]; /* program nam
void
initsetproctitle(int argc, char **argv, char **envp)
{
- register int i;
+ int i;
char *tmp;
/*
@@ -111,8 +111,8 @@ initsetproctitle(int argc, char **argv,
void
setproctitle(const char *fmt, ...)
{
- register char *p;
- register int i=0;
+ char *p;
+ int i=0;
static char buf[2048];
va_list ap;
--- a/telnetd/slc.c
+++ b/telnetd/slc.c
@@ -196,7 +196,7 @@ int end_slc(unsigned char **bufp) {
* Figure out what to do about the client's slc
*/
void process_slc(unsigned char func, unsigned char flag, cc_t val) {
- register int hislevel, mylevel, ack;
+ int hislevel, mylevel, ack;
/*
* Ensure that we know something about this function
@@ -260,7 +260,7 @@ void process_slc(unsigned char func, uns
* Compare client's request with what we are capable of supporting.
*/
void change_slc(char func, char flag, cc_t val) {
- register int hislevel, mylevel;
+ int hislevel, mylevel;
hislevel = flag & SLC_LEVELBITS;
mylevel = slctab[func].defset.flag & SLC_LEVELBITS;
--- a/telnetd/state.c
+++ b/telnetd/state.c
@@ -79,7 +79,7 @@ unsigned char subbuffer[512], *subpointe
#define TS_DONT 8 /* dont " */
void telrcv(void) {
- register int c;
+ int c;
static int state = TS_DATA;
while (ncc > 0) {
@@ -1081,7 +1081,7 @@ void suboption(void) {
#ifdef LINEMODE
case TELOPT_LINEMODE: {
- register int request;
+ int request;
if (his_state_is_wont(TELOPT_LINEMODE)) /* Ignore if option disabled */
break;
@@ -1158,8 +1158,8 @@ void suboption(void) {
} /* end of case TELOPT_XDISPLOC */
case TELOPT_ENVIRON: {
- register int c;
- register char *cp, *varp, *valp;
+ int c;
+ char *cp, *varp, *valp;
if (SB_EOF())
return;
@@ -1299,8 +1299,8 @@ static void doclientstat(void) {
void send_status(void) {
unsigned char statusbuf[256];
- register unsigned char *ncp;
- register unsigned char i;
+ unsigned char *ncp;
+ unsigned char i;
ncp = statusbuf;
--- a/telnetd/sys_term.c
+++ b/telnetd/sys_term.c
@@ -413,7 +413,7 @@ extern int def_tspeed, def_rspeed;
static int getptyslave(void) {
#if 0
- register int t = -1;
+ int t = -1;
# ifdef LINEMODE
int waslm;
@@ -505,7 +505,7 @@ static int getptyslave(void) {
* making sure that we have a clean tty.
*/
static int cleanopen(char *lyne) {
- register int t;
+ int t;
/*
* Make sure that other people can't open the
--- a/telnetd/telnetd.c
+++ b/telnetd/telnetd.c
@@ -93,7 +93,7 @@ main(int argc, char *argv[], char *env[]
struct sockaddr_in from;
int on = 1;
socklen_t fromlen;
- register int ch;
+ int ch;
#if defined(HAS_IPPROTO_IP) && defined(IP_TOS)
int tos = -1;
@@ -837,7 +837,7 @@ void telnet(int f, int p)
#ifdef TIOCNOTTY
{
- register int t;
+ int t;
t = open(_PATH_TTY, O_RDWR);
if (t >= 0) {
(void) ioctl(t, TIOCNOTTY, (char *)0);
--- a/telnetd/termstat.c
+++ b/telnetd/termstat.c
@@ -347,7 +347,7 @@ done:
* at a time, and if using kludge linemode, then only linemode may be
* affected.
*/
-void clientstat(register int code, register int parm1, register int parm2)
+void clientstat(int code, register int parm1, register int parm2)
{
/*
* Get a copy of terminal characteristics.
@@ -419,7 +419,7 @@ void clientstat(register int code, regis
case LM_MODE:
{
- register int ack, changed;
+ int ack, changed;
/*
* Client has sent along a mode mask. If it agrees with
--- a/telnetd/utility.c
+++ b/telnetd/utility.c
@@ -189,7 +189,7 @@ nextitem(char *current, const char *endp
return current+3 <= endp ? current+3 : NULL;
case SB: /* loop forever looking for the SE */
{
- register char *look = current+2;
+ char *look = current+2;
while (look < endp) {
if ((*look++&0xff) == IAC) {
@@ -224,7 +224,7 @@ nextitem(char *current, const char *endp
*/
void netclear(void)
{
- register char *thisitem, *next;
+ char *thisitem, *next;
char *good;
#define wewant(p) ((nfrontp > p) && ((*p&0xff) == IAC) && \
(nfrontp > p+1 && (((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL))))
@@ -354,7 +354,7 @@ netflush(void)
* ptr - A pointer to a character string to write
* len - How many bytes to write
*/
-void writenet(register unsigned char *ptr, register int len)
+void writenet(unsigned char *ptr, register int len)
{
/* flush buffer if no room for new data) */
if ((&netobuf[BUFSIZ] - nfrontp) < len) {
@@ -589,7 +589,7 @@ printoption(const char *fmt, int option)
void
printsub(char direction, unsigned char *pointer, int length)
{
- register int i = -1;
+ int i = -1;
#ifdef AUTHENTICATE
char buf[512];
#endif
@@ -601,7 +601,7 @@ printsub(char direction, unsigned char *
netoprintf("td: %s suboption ",
direction == '<' ? "recv" : "send");
if (length >= 3) {
- register int j;
+ int j;
i = pointer[length-2];
j = pointer[length-1];
@@ -817,7 +817,7 @@ printsub(char direction, unsigned char *
case TELOPT_STATUS: {
const char *cp;
- register int j, k;
+ int j, k;
netoprintf("STATUS");
@@ -914,7 +914,7 @@ printsub(char direction, unsigned char *
netoprintf("INFO ");
env_common:
{
- register int noquote = 2;
+ int noquote = 2;
for (i = 2; i < length; i++ ) {
switch (pointer[i]) {
case ENV_VAR:
@@ -1125,7 +1125,7 @@ printsub(char direction, unsigned char *
void
printdata(const char *tag, const char *ptr, int cnt)
{
- register int i;
+ int i;
char xbuf[30];
while (cnt) {

View File

@@ -0,0 +1,114 @@
From 06ed6a6bf25a22902846097d6b6c97e070c2c326 Mon Sep 17 00:00:00 2001
From: Seiichi Ishitsuka <ishitsuka.sc@ncos.nec.co.jp>
Date: Fri, 1 Jun 2018 14:27:35 +0900
Subject: [PATCH] telnetd: Fix deadlock on cleanup
The cleanup function in telnetd is called both directly and on SIGCHLD
signals. This, unfortunately, triggered a deadlock in eglibc 2.9 while
running on a 2.6.31.11 kernel.
What we were seeing is hangs like these:
(gdb) bt
#0 0xb7702424 in __kernel_vsyscall ()
#1 0xb7658e61 in __lll_lock_wait_private () from ./lib/libc.so.6
#2 0xb767e7b5 in _L_lock_15 () from ./lib/libc.so.6
#3 0xb767e6e0 in utmpname () from ./lib/libc.so.6
#4 0xb76bcde7 in logout () from ./lib/libutil.so.1
#5 0x0804c827 in cleanup ()
#6 <signal handler called>
#7 0xb7702424 in __kernel_vsyscall ()
#8 0xb7641003 in __fcntl_nocancel () from ./lib/libc.so.6
#9 0xb767e0c3 in getutline_r_file () from ./lib/libc.so.6
#10 0xb767d675 in getutline_r () from ./lib/libc.so.6
#11 0xb76bce42 in logout () from ./lib/libutil.so.1
#12 0x0804c827 in cleanup ()
#13 0x0804a0b5 in telnet ()
#14 0x0804a9c3 in main ()
and what has happened here is that the user closes the telnet session
via the escape character. This causes telnetd to call cleanup in frame
the SIGCHLD signal is delivered while telnetd is executing cleanup.
Telnetd then calls the signal handler for SIGCHLD, which is cleanup().
Ouch. The actual deadlock is in libc. getutline_r in frame #10 gets the
__libc_utmp_lock lock, and utmpname above does the same thing in frame
The fix registers the SIGCHLD handler as cleanup_sighandler, and makes
cleanup disable the SIGCHLD signal before calling cleanup_sighandler.
Signed-off-by: Simon Kagstrom <simon.kagstrom@netinsight.net>
The patch was imported from the Ubuntu netkit-telnet package.
(https://bugs.launchpad.net/ubuntu/+source/netkit-telnet/+bug/507455)
A previous patch declaring attributes of functions, but it is not used
in upstream.
Signed-off-by: Seiichi Ishitsuka <ishitsuka.sc@ncos.nec.co.jp>
---
telnetd/ext.h | 1 +
telnetd/sys_term.c | 17 ++++++++++++++++-
telnetd/telnetd.c | 2 +-
3 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/telnetd/ext.h b/telnetd/ext.h
index b98d6ec..08f9d07 100644
--- a/telnetd/ext.h
+++ b/telnetd/ext.h
@@ -97,6 +97,7 @@ void add_slc(int, int, int);
void check_slc(void);
void change_slc(int, int, int);
void cleanup(int);
+void cleanup_sighandler(int);
void clientstat(int, int, int);
void copy_termbuf(char *, int);
void deferslc(void);
diff --git a/telnetd/sys_term.c b/telnetd/sys_term.c
index 5b4aa84..c4fb0f7 100644
--- a/telnetd/sys_term.c
+++ b/telnetd/sys_term.c
@@ -719,7 +719,7 @@ static void addarg(struct argv_stuff *avs, const char *val) {
* This is the routine to call when we are all through, to
* clean up anything that needs to be cleaned up.
*/
-void cleanup(int sig) {
+void cleanup_sighandler(int sig) {
char *p;
(void)sig;
@@ -742,3 +742,18 @@ void cleanup(int sig) {
shutdown(net, 2);
exit(0);
}
+
+void cleanup(int sig) {
+ sigset_t mask, oldmask;
+
+ /* Set up the mask of signals to temporarily block. */
+ sigemptyset (&mask);
+ sigaddset (&mask, SIGCHLD);
+
+ /* Block SIGCHLD while running cleanup */
+ sigprocmask (SIG_BLOCK, &mask, &oldmask);
+
+ cleanup_sighandler(sig);
+ /* Technically not needed since cleanup_sighandler exits */
+ sigprocmask (SIG_UNBLOCK, &mask, NULL);
+}
diff --git a/telnetd/telnetd.c b/telnetd/telnetd.c
index 9ace838..788919c 100644
--- a/telnetd/telnetd.c
+++ b/telnetd/telnetd.c
@@ -833,7 +833,7 @@ void telnet(int f, int p)
signal(SIGTTOU, SIG_IGN);
#endif
- signal(SIGCHLD, cleanup);
+ signal(SIGCHLD, cleanup_sighandler);
#ifdef TIOCNOTTY
{
--
2.7.4

View File

@@ -0,0 +1,66 @@
From 7a3095d1e9b7c73f9dca56250f433bcfc7cb660e Mon Sep 17 00:00:00 2001
From: Khem Raj <raj.khem@gmail.com>
Date: Tue, 27 Jun 2017 10:15:34 -0700
Subject: [PATCH] telnet/telnetd: Fix print format strings
Fixes build with hardening flags
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
telnet/utilities.cc | 6 +++---
telnetd/utility.c | 6 +++---
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/telnet/utilities.cc b/telnet/utilities.cc
index 66839ab..36f0731 100644
--- a/telnet/utilities.cc
+++ b/telnet/utilities.cc
@@ -583,17 +583,17 @@ void printsub(int direction, unsigned char *pointer, int length) {
case ENV_VAR:
if (pointer[1] == TELQUAL_SEND)
goto def_case;
- fprintf(NetTrace, "\" VAR " + noquote);
+ fprintf(NetTrace, "%s", "\" VAR " + noquote);
noquote = 2;
break;
case ENV_VALUE:
- fprintf(NetTrace, "\" VALUE " + noquote);
+ fprintf(NetTrace, "%s", "\" VALUE " + noquote);
noquote = 2;
break;
case ENV_ESC:
- fprintf(NetTrace, "\" ESC " + noquote);
+ fprintf(NetTrace, "%s", "\" ESC " + noquote);
noquote = 2;
break;
diff --git a/telnetd/utility.c b/telnetd/utility.c
index 29b7da1..75314cb 100644
--- a/telnetd/utility.c
+++ b/telnetd/utility.c
@@ -909,17 +909,17 @@ printsub(char direction, unsigned char *pointer, int length)
case ENV_VAR:
if (pointer[1] == TELQUAL_SEND)
goto def_case;
- netoprintf("\" VAR " + noquote);
+ netoprintf("%s", "\" VAR " + noquote);
noquote = 2;
break;
case ENV_VALUE:
- netoprintf("\" VALUE " + noquote);
+ netoprintf("%s", "\" VALUE " + noquote);
noquote = 2;
break;
case ENV_ESC:
- netoprintf("\" ESC " + noquote);
+ netoprintf("%s", "\" ESC " + noquote);
noquote = 2;
break;
--
2.13.2

View File

@@ -0,0 +1,56 @@
From 9c81c8e5bc7782e8ae12c078615abc3c896059f2 Mon Sep 17 00:00:00 2001
From: Julius Hemanth Pitti <jpitti@cisco.com>
Date: Tue, 14 Jul 2020 22:34:19 -0700
Subject: [PATCH] telnetd/utility.c: Fix buffer overflow in netoprintf
As per man page of vsnprintf, when formated
string size is greater than "size"(2nd argument),
then vsnprintf returns size of formated string,
not "size"(2nd argument).
netoprintf() was not handling a case where
return value of vsnprintf is greater than
"size"(2nd argument), results in buffer overflow
while adjusting "nfrontp" pointer to point
beyond "netobuf" buffer.
Here is one such case where "nfrontp"
crossed boundaries of "netobuf", and
pointing to another global variable.
(gdb) p &netobuf[8255]
$5 = 0x55c93afe8b1f <netobuf+8255> ""
(gdb) p nfrontp
$6 = 0x55c93afe8c20 <terminaltype> "\377"
(gdb) p &terminaltype
$7 = (char **) 0x55c93afe8c20 <terminaltype>
(gdb)
This resulted in crash of telnetd service
with segmentation fault.
Though this is DoS security bug, I couldn't
find any CVE ID for this.
Upstream-Status: Pending
Signed-off-by: Julius Hemanth Pitti <jpitti@cisco.com>
---
telnetd/utility.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/telnetd/utility.c b/telnetd/utility.c
index b9a46a6..4811f14 100644
--- a/telnetd/utility.c
+++ b/telnetd/utility.c
@@ -66,7 +66,7 @@ netoprintf(const char *fmt, ...)
len = vsnprintf(nfrontp, maxsize, fmt, ap);
va_end(ap);
- if (len<0 || len==maxsize) {
+ if (len<0 || len>=maxsize) {
/* didn't fit */
netflush();
}
--
2.19.1

View File

@@ -0,0 +1,27 @@
From 23b068e695881be0e8205ecccadf775fc3d5889d Mon Sep 17 00:00:00 2001
From: Khem Raj <raj.khem@gmail.com>
Date: Tue, 6 Sep 2022 21:25:50 -0700
Subject: [PATCH] utility: Include time.h form time() and strftime() prototypes
Upstream-Status: Pending
Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
telnetd/utility.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/telnetd/utility.c b/telnetd/utility.c
index 4811f14..b539777 100644
--- a/telnetd/utility.c
+++ b/telnetd/utility.c
@@ -40,6 +40,7 @@ char util_rcsid[] =
#define PRINTOPTIONS
#include <stdarg.h>
+#include <time.h> /* for time() anf strftime() */
#include <sys/utsname.h>
#ifdef AUTHENTICATE
--
2.37.3

View File

@@ -0,0 +1,112 @@
From 6ab007dbb1958371abff2eaaad2b26da89b3c74e Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 24 Apr 2020 09:43:44 +0800
Subject: [PATCH] telnetd/utility.c: fix CVE-2020-10188
Upstream-Status: Backport
[Fedora: https://src.fedoraproject.org/rpms/telnet/raw/master/f/telnet-0.17-overflow-exploit.patch]
CVE: CVE-2020-10188
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
telnetd/utility.c | 32 +++++++++++++++++++++-----------
1 file changed, 21 insertions(+), 11 deletions(-)
diff --git a/telnetd/utility.c b/telnetd/utility.c
index 75314cb..b9a46a6 100644
--- a/telnetd/utility.c
+++ b/telnetd/utility.c
@@ -169,31 +169,38 @@ void ptyflush(void)
*/
static
char *
-nextitem(char *current)
+nextitem(char *current, const char *endp)
{
+ if (current >= endp) {
+ return NULL;
+ }
if ((*current&0xff) != IAC) {
return current+1;
}
+ if (current+1 >= endp) {
+ return NULL;
+ }
switch (*(current+1)&0xff) {
case DO:
case DONT:
case WILL:
case WONT:
- return current+3;
+ return current+3 <= endp ? current+3 : NULL;
case SB: /* loop forever looking for the SE */
{
register char *look = current+2;
- for (;;) {
+ while (look < endp) {
if ((*look++&0xff) == IAC) {
- if ((*look++&0xff) == SE) {
+ if (look < endp && (*look++&0xff) == SE) {
return look;
}
}
}
+ return NULL;
}
default:
- return current+2;
+ return current+2 <= endp ? current+2 : NULL;
}
} /* end of nextitem */
@@ -219,7 +226,7 @@ void netclear(void)
register char *thisitem, *next;
char *good;
#define wewant(p) ((nfrontp > p) && ((*p&0xff) == IAC) && \
- ((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL))
+ (nfrontp > p+1 && (((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL))))
#if defined(ENCRYPT)
thisitem = nclearto > netobuf ? nclearto : netobuf;
@@ -227,7 +234,7 @@ void netclear(void)
thisitem = netobuf;
#endif
- while ((next = nextitem(thisitem)) <= nbackp) {
+ while ((next = nextitem(thisitem, nbackp)) != NULL && next <= nbackp) {
thisitem = next;
}
@@ -239,20 +246,23 @@ void netclear(void)
good = netobuf; /* where the good bytes go */
#endif
- while (nfrontp > thisitem) {
+ while (thisitem != NULL && nfrontp > thisitem) {
if (wewant(thisitem)) {
int length;
next = thisitem;
do {
- next = nextitem(next);
- } while (wewant(next) && (nfrontp > next));
+ next = nextitem(next, nfrontp);
+ } while (next != NULL && wewant(next) && (nfrontp > next));
+ if (next == NULL) {
+ next = nfrontp;
+ }
length = next-thisitem;
bcopy(thisitem, good, length);
good += length;
thisitem = next;
} else {
- thisitem = nextitem(thisitem);
+ thisitem = nextitem(thisitem, nfrontp);
}
}
--
2.7.4

View File

@@ -0,0 +1,41 @@
From 31362e4c0d02b4a2b952ad0dd32acfb573c442f3 Mon Sep 17 00:00:00 2001
From: Li xin <lixin.fnst@cn.fujitsu.com>
Date: Fri, 28 Nov 2014 07:17:40 +0900
Subject: [PATCH 2/2] WARNING Fix and modify "CFLAGS"
WARNING: QA Issue: File '/usr/sbin/in.telnetd' from netkit-telnet was
already stripped, this will prevent future debugging! [already-stripped]
Upstream-Status: Pending
Signed-off-by: Li Xin <lixin.fnst@cn.fujitsu.com>
---
telnetd/Makefile | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/telnetd/Makefile b/telnetd/Makefile
index 72650b4..a4cf9fa 100644
--- a/telnetd/Makefile
+++ b/telnetd/Makefile
@@ -9,7 +9,8 @@ include ../MRULES
# take out -DPARANOID_TTYS.
CFLAGS += '-DISSUE_FILE="/etc/issue.net"' -DPARANOID_TTYS \
- -DNO_REVOKE -DKLUDGELINEMODE -DDIAGNOSTICS
+ -DNO_REVOKE -DKLUDGELINEMODE -DDIAGNOSTICS \
+ -DLOGIN_WRAPPER=\"/${libdir}/telnetlogin\"
# LIBS += $(LIBTERMCAP)
OBJS = telnetd.o state.o termstat.o slc.o sys_term.o utility.o \
@@ -27,7 +28,7 @@ $(OBJS): defs.h ext.h pathnames.h telnetd.h logwtmp.h logout.h setproctitle.h
telnetd.o: ../version.h
install: telnetd
- install -s -m$(DAEMONMODE) telnetd $(INSTALLROOT)$(SBINDIR)/in.telnetd
+ install -m$(DAEMONMODE) telnetd $(INSTALLROOT)$(SBINDIR)/in.telnetd
install -m$(MANMODE) issue.net.5 $(INSTALLROOT)$(MANDIR)/man5/
install -m$(MANMODE) telnetd.8 $(INSTALLROOT)$(MANDIR)/man8/in.telnetd.8
ln -sf in.telnetd.8 $(INSTALLROOT)$(MANDIR)/man8/telnetd.8
--
1.8.4.2

View File

@@ -0,0 +1,48 @@
To support the cross-compile
Upstream-Status: Pending
make the configure to support the cross-compile, by only to compile the
target, and not to run it
Roy Li <rongqing.li@windriver.com>
Index: netkit-telnet-0.17/configure
===================================================================
--- netkit-telnet-0.17.orig/configure 2008-11-23 22:01:26.000000000 +0100
+++ netkit-telnet-0.17/configure 2008-11-23 22:05:00.000000000 +0100
@@ -94,7 +94,7 @@
echo -n 'Checking if C compiler works... '
if (
$CC __conftest.c -o __conftest || exit 1
- ./__conftest || exit 1
+ # Idiots belong shot! ./__conftest || exit 1
) >/dev/null 2>&1; then
echo 'yes'
else
@@ -141,7 +141,7 @@
echo -n 'Checking if C++ compiler works... '
if (
$CXX __conftest.cc -o __conftest || exit 1
- ./__conftest || exit 1
+ # Iditios belong shot! ./__conftest || exit 1
) >/dev/null 2>&1; then
echo 'yes'
else
@@ -284,7 +284,7 @@
else
if (
$CXX $CXXFLAGS -D__USE_BSD_SIGNAL __conftest.cc -o __conftest || exit 1
- ./__conftest || exit 1
+ # running still does not work./__conftest || exit 1
) >/dev/null 2>&1; then
echo '-D__USE_BSD_SIGNAL'
CFLAGS="$CFLAGS -D__USE_BSD_SIGNAL"
@@ -501,7 +501,7 @@
EOF
if (
$CXX $CXXFLAGS __conftest.cc $LIBBSD -o __conftest || exit 1
- ./__conftest || exit 1
+ # argh! morons!./__conftest || exit 1
) >/dev/null 2>&1; then
echo 'ok'
else

View File

@@ -0,0 +1,14 @@
# default: on
# description: The telnet server serves telnet sessions; it uses \
# unencrypted username/password pairs for authentication.
service telnet
{
flags = REUSE
socket_type = stream
wait = no
user = root
server = /usr/sbin/in.telnetd
log_on_failure += USERID
disable = yes
}