Buf oflow fix from Warner Losh <imp@rover.village.org>

3 files changed, 23 insertions, 21 deletions

diff --git a/usr.bin/tip/cmds.c b/usr.bin/tip/cmds.c
index 96ca35c5f68..1a81d83de37 100644
--- a/usr.bin/tip/cmds.c
+++ b/usr.bin/tip/cmds.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cmds.c,v 1.5 1997/04/02 01:47:01 millert Exp $	*/
+/*	$OpenBSD: cmds.c,v 1.6 1997/08/22 22:42:07 millert Exp $	*/
 /*	$NetBSD: cmds.c,v 1.7 1997/02/11 09:24:03 mrg Exp $	*/
 
 /*
@@ -38,7 +38,7 @@
 #if 0
 static char sccsid[] = "@(#)cmds.c	8.1 (Berkeley) 6/6/93";
 #endif
-static char rcsid[] = "$OpenBSD: cmds.c,v 1.5 1997/04/02 01:47:01 millert Exp $";
+static char rcsid[] = "$OpenBSD: cmds.c,v 1.6 1997/08/22 22:42:07 millert Exp $";
 #endif /* not lint */
 
 #include "tip.h"
@@ -73,7 +73,7 @@ getfl(c)
 	/*
 	 * get the UNIX receiving file's name
 	 */
-	if (prompt("Local file name? ", copyname))
+	if (prompt("Local file name? ", copyname, sizeof(copyname)))
 		return;
 	cp = expand(copyname);
 	if ((sfd = creat(cp, 0666)) < 0) {
@@ -84,7 +84,7 @@ getfl(c)
 	/*
 	 * collect parameters
 	 */
-	if (prompt("List command for remote system? ", buf)) {
+	if (prompt("List command for remote system? ", buf, sizeof(buf))) {
 		unlink(copyname);
 		return;
 	}
@@ -100,7 +100,7 @@ cu_take(cc)
 	int fd, argc;
 	char line[BUFSIZ], *expand(), *cp;
 
-	if (prompt("[take] ", copyname))
+	if (prompt("[take] ", copyname, sizeof(copyname)))
 		return;
 	if ((argc = args(copyname, argv)) < 1 || argc > 2) {
 		printf("usage: <take> from [to]\r\n");
@@ -197,7 +197,7 @@ pipefile()
 	int status, p;
 	extern int errno;
 
-	if (prompt("Local command? ", buf))
+	if (prompt("Local command? ", buf, sizeof(buf)))
 		return;
 
 	if (pipe(pdes)) {
@@ -209,7 +209,7 @@ pipefile()
 		printf("can't fork!\r\n");
 		return;
 	} else if (cpid) {
-		if (prompt("List command for remote system? ", buf)) {
+		if (prompt("List command for remote system? ", buf, sizeof(buf))) {
 			close(pdes[0]), close(pdes[1]);
 			kill (cpid, SIGKILL);
 		} else {
@@ -260,7 +260,7 @@ sendfile(cc)
 	/*
 	 * get file name
 	 */
-	if (prompt("Local file name? ", fname))
+	if (prompt("Local file name? ", fname, sizeof(fname)))
 		return;
 
 	/*
@@ -386,7 +386,7 @@ cu_put(cc)
 	char *expand();
 	char *copynamex;
 
-	if (prompt("[put] ", copyname))
+	if (prompt("[put] ", copyname, sizeof(copyname)))
 		return;
 	if ((argc = args(copyname, argv)) < 1 || argc > 2) {
 		printf("usage: <put> from [to]\r\n");
@@ -462,7 +462,7 @@ pipeout(c)
 	time_t start;
 
 	putchar(c);
-	if (prompt("Local command? ", buf))
+	if (prompt("Local command? ", buf, sizeof(buf)))
 		return;
 	kill(pid, SIGIOT);	/* put TIPOUT into a wait state */
 	signal(SIGINT, SIG_IGN);
@@ -513,7 +513,7 @@ consh(c)
 	time_t start;
 
 	putchar(c);
-	if (prompt("Local command? ", buf))
+	if (prompt("Local command? ", buf, sizeof(buf)))
 		return;
 	kill(pid, SIGIOT);	/* put TIPOUT into a wait state */
 	signal(SIGINT, SIG_IGN);
@@ -614,10 +614,10 @@ setscript()
  */
 chdirectory()
 {
-	char dirname[80];
+	char dirname[PATH_MAX];
 	register char *cp = dirname;
 
-	if (prompt("[cd] ", dirname)) {
+	if (prompt("[cd] ", dirname, sizeof(dirname))) {
 		if (stoprompt)
 			return;
 		cp = value(HOME);
@@ -721,7 +721,7 @@ variable()
 {
 	char	buf[256];
 
-	if (prompt("[set] ", buf))
+	if (prompt("[set] ", buf, sizeof(buf)))
 		return;
 	vlex(buf);
 	if (vtable[BEAUTIFY].v_access&CHANGED) {
diff --git a/usr.bin/tip/tip.c b/usr.bin/tip/tip.c
index f022c8919f0..f35cbf111a8 100644
--- a/usr.bin/tip/tip.c
+++ b/usr.bin/tip/tip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tip.c,v 1.5 1997/04/20 23:29:33 millert Exp $	*/
+/*	$OpenBSD: tip.c,v 1.6 1997/08/22 22:42:07 millert Exp $	*/
 /*	$NetBSD: tip.c,v 1.13 1997/04/20 00:03:05 mellon Exp $	*/
 
 /*
@@ -44,7 +44,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)tip.c	8.1 (Berkeley) 6/6/93";
 #endif
-static char rcsid[] = "$OpenBSD: tip.c,v 1.5 1997/04/20 23:29:33 millert Exp $";
+static char rcsid[] = "$OpenBSD: tip.c,v 1.6 1997/08/22 22:42:07 millert Exp $";
 #endif /* not lint */
 
 /*
@@ -300,9 +300,10 @@ static	jmp_buf promptbuf;
  *  in from the terminal.  Handles signals & allows use of
  *  normal erase and kill characters.
  */
-prompt(s, p)
+prompt(s, p, sz)
 	char *s;
 	register char *p;
+	size_t sz;
 {
 	register int c;
 	register char *b = p;
@@ -314,7 +315,7 @@ prompt(s, p)
 	unraw();
 	printf("%s", s);
 	if (setjmp(promptbuf) == 0)
-		while ((c = getchar()) != EOF && (*p = c) != '\n')
+		while ((c = getchar()) != EOF && (*p = c) != '\n' && --sz > 0)
 			p++;
 	*p = '\0';
 
diff --git a/usr.bin/tip/tip.h b/usr.bin/tip/tip.h
index 2b5a8bda9fe..7fb9fe035a4 100644
--- a/usr.bin/tip/tip.h
+++ b/usr.bin/tip/tip.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tip.h,v 1.6 1997/04/20 23:29:33 millert Exp $	*/
+/*	$OpenBSD: tip.h,v 1.7 1997/08/22 22:42:08 millert Exp $	*/
 /*	$NetBSD: tip.h,v 1.7 1997/04/20 00:02:46 mellon Exp $	*/
 
 /*
@@ -55,6 +55,7 @@
 #include <setjmp.h>
 #include <unistd.h>
 #include <errno.h>
+#include <limits.h>
 
 /*
  * Remote host attributes
@@ -254,8 +255,8 @@ int	cumode;			/* simulating the "cu" program */
 int	bits8;			/* terminal is is 8-bit mode */
 #define STRIP_PAR	(bits8 ? 0377 : 0177)
 
-char	fname[80];		/* file name buffer for ~< */
-char	copyname[80];		/* file name buffer for ~> */
+char	fname[PATH_MAX];	/* file name buffer for ~< */
+char	copyname[PATH_MAX];	/* file name buffer for ~> */
 char	ccc;			/* synchronization character */
 char	ch;			/* for tipout */
 char	*uucplock;		/* name of lock file for uucp's */