diff options
| author | Ricardo Mestre <mestre@cvs.openbsd.org> | 2019-11-08 07:26:39 +0000 |
|---|---|---|
| committer | Ricardo Mestre <mestre@cvs.openbsd.org> | 2019-11-08 07:26:39 +0000 |
| commit | 3e2c63c3eb1db0b2aedfe16c9b4b54e40ef67729 (patch) | |
| tree | 504dac790f8c4d2ead529f56c76be5ff1d8e6c18 /usr.sbin/lpd | |
| parent | cc9483a80803855ffa3376b13ebbd8b6e388cee1 (diff) | |
fix bogus pointer/double free crash, when /etc/printcap db file is not present,
by adding a missing check for the return value -1 on both cgetfirst(3) and
cgetnext(3)
OK millert@ deraadt@
Diffstat (limited to 'usr.sbin/lpd')
| -rw-r--r-- | usr.sbin/lpd/lp.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/usr.sbin/lpd/lp.c b/usr.sbin/lpd/lp.c index 0d39a05a1c1..adcfb32d0c9 100644 --- a/usr.sbin/lpd/lp.c +++ b/usr.sbin/lpd/lp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: lp.c,v 1.1 2018/04/27 16:14:36 eric Exp $ */ +/* $OpenBSD: lp.c,v 1.2 2019/11/08 07:26:38 mestre Exp $ */ /* * Copyright (c) 2017 Eric Faurot <eric@openbsd.org> @@ -116,15 +116,15 @@ lp_scanprinters(struct lp_printer *lp) cgetclose(); scanning = 0; return 0; - } - else if (r == 1) { + } else if (r == 1) { memset(lp, 0, sizeof(*lp)); r = readent(lp, buf); free(buf); if (r == -2) goto fail; return 1; - } + } else if (r == -1) + fatal("cannot open %s", _PATH_PRINTCAP); else if (r == -2) errno = ELOOP; /* potential reference loop */ |