Check that last character is a newline before truncating; prevents

negative index array access.

OK moritz@.

1 files changed, 18 insertions, 7 deletions

diff --git a/usr.sbin/ppp/ppp/auth.c b/usr.sbin/ppp/ppp/auth.c
index d33630bb715..d24da995a89 100644
--- a/usr.sbin/ppp/ppp/auth.c
+++ b/usr.sbin/ppp/ppp/auth.c
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $OpenBSD: auth.c,v 1.19 2005/09/07 01:36:02 brad Exp $
+ * $OpenBSD: auth.c,v 1.20 2006/11/02 18:27:29 ray Exp $
  */
 
 #include <sys/param.h>
@@ -124,10 +124,13 @@ auth_SetPhoneList(const char *name, char *phone, int phonelen)
 again:
     lineno = 0;
     while (fgets(buff, sizeof buff, fp)) {
+      char *p;
+
       lineno++;
       if (buff[0] == '#')
         continue;
-      buff[strlen(buff) - 1] = '\0';
+      if ((p = strchr(buff, '\n')) != NULL)
+	*p = '\0';
       memset(vector, '\0', sizeof vector);
       if ((n = MakeArgs(buff, vector, VECSIZE(vector), PARSE_REDUCE)) < 0)
         log_Printf(LogWARN, "%s: %d: Invalid line\n", SECRETFILE, lineno);
@@ -185,10 +188,13 @@ auth_Select(struct bundle *bundle, const char *name)
 again:
     lineno = 0;
     while (fgets(buff, sizeof buff, fp)) {
+      char *p;
+
       lineno++;
       if (buff[0] == '#')
         continue;
-      buff[strlen(buff) - 1] = '\0';
+      if ((p = strchr(buff, '\n')) != NULL)
+	*p = '\0';
       memset(vector, '\0', sizeof vector);
       if ((n = MakeArgs(buff, vector, VECSIZE(vector), PARSE_REDUCE)) < 0)
         log_Printf(LogWARN, "%s: %d: Invalid line\n", SECRETFILE, lineno);
@@ -253,10 +259,13 @@ again:
   lineno = 0;
   if (fp != NULL) {
     while (fgets(buff, sizeof buff, fp)) {
+      char *p;
+
       lineno++;
       if (buff[0] == '#')
         continue;
-      buff[strlen(buff) - 1] = 0;
+      if ((p = strchr(buff, '\n')) != NULL)
+	*p = '\0';
       memset(vector, '\0', sizeof vector);
       if ((n = MakeArgs(buff, vector, VECSIZE(vector), PARSE_REDUCE)) < 0)
         log_Printf(LogWARN, "%s: %d: Invalid line\n", SECRETFILE, lineno);
@@ -308,12 +317,14 @@ auth_GetSecret(struct bundle *bundle, const char *name, int len,
 again:
   lineno = 0;
   while (fgets(buff, sizeof buff, fp)) {
+    char *p;
+
     lineno++;
     if (buff[0] == '#')
       continue;
-    n = strlen(buff) - 1;
-    if (buff[n] == '\n')
-      buff[n] = '\0';	/* Trim the '\n' */
+    /* Trim the '\n' */
+    if ((p = strchr(buff, '\n')) != NULL)
+      *p = '\0';
     memset(vector, '\0', sizeof vector);
     if ((n = MakeArgs(buff, vector, VECSIZE(vector), PARSE_REDUCE)) < 0)
       log_Printf(LogWARN, "%s: %d: Invalid line\n", SECRETFILE, lineno);