snprintf audit. debug inet_neta() on non-continuous masks (like 0.255.0.255),

more pickier string manipulation.  deraadt ok

1 files changed, 22 insertions, 14 deletions

diff --git a/lib/libc/net/inet_neta.c b/lib/libc/net/inet_neta.c
index 881a328ab02..6960bcd0b5b 100644
--- a/lib/libc/net/inet_neta.c
+++ b/lib/libc/net/inet_neta.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: inet_neta.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $	*/
+/*	$OpenBSD: inet_neta.c,v 1.4 2002/08/19 03:01:54 itojun Exp $	*/
 
 /*
  * Copyright (c) 1996 by Internet Software Consortium.
@@ -19,9 +19,9 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 #if 0
-static const char rcsid[] = "$Id: inet_neta.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $";
+static const char rcsid[] = "$Id: inet_neta.c,v 1.4 2002/08/19 03:01:54 itojun Exp $";
 #else
-static const char rcsid[] = "$OpenBSD: inet_neta.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $";
+static const char rcsid[] = "$OpenBSD: inet_neta.c,v 1.4 2002/08/19 03:01:54 itojun Exp $";
 #endif
 #endif
 
@@ -52,29 +52,37 @@ inet_neta(src, dst, size)
 	size_t size;
 {
 	char *odst = dst;
-	char *tp;
+	char *ep;
+	int advance;
 
+	if (src == 0x00000000) {
+		if (size < sizeof "0.0.0.0")
+			goto emsgsize;
+		strlcpy(dst, "0.0.0.0", size);
+		return dst;
+	}
+	ep = dst + size;
+	if (ep <= dst)
+		goto emsgsize;
 	while (src & 0xffffffff) {
 		u_char b = (src & 0xff000000) >> 24;
 
 		src <<= 8;
-		if (b) {
-			if (size < sizeof "255.")
+		if (b || src) {
+			if (ep - dst < sizeof "255.")
+				goto emsgsize;
+			advance = snprintf(dst, ep - dst, "%u", b);
+			if (advance <= 0 || advance >= ep - dst)
 				goto emsgsize;
-			tp = dst;
-			dst += sprintf(dst, "%u", b);
+			dst += advance;
 			if (src != 0L) {
+				if (dst + 1 >= ep)
+					goto emsgsize;
 				*dst++ = '.';
 				*dst = '\0';
 			}
-			size -= (size_t)(dst - tp);
 		}
 	}
-	if (dst == odst) {
-		if (size < sizeof "0.0.0.0")
-			goto emsgsize;
-		strlcpy(dst, "0.0.0.0", size);
-	}
 	return (odst);
 
  emsgsize: