diff options
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/lpr/common_source/rmjob.c | 35 |
1 files changed, 24 insertions, 11 deletions
diff --git a/usr.sbin/lpr/common_source/rmjob.c b/usr.sbin/lpr/common_source/rmjob.c index 1e7f13dbd56..041c98129be 100644 --- a/usr.sbin/lpr/common_source/rmjob.c +++ b/usr.sbin/lpr/common_source/rmjob.c @@ -1,4 +1,4 @@ -/* $OpenBSD: rmjob.c,v 1.14 2002/06/08 01:53:43 millert Exp $ */ +/* $OpenBSD: rmjob.c,v 1.15 2003/02/13 17:22:01 millert Exp $ */ /* $NetBSD: rmjob.c,v 1.16 2000/04/16 14:43:58 mrg Exp $ */ /* @@ -38,7 +38,7 @@ #if 0 static const char sccsid[] = "@(#)rmjob.c 8.2 (Berkeley) 4/28/95"; #else -static const char rcsid[] = "$OpenBSD: rmjob.c,v 1.14 2002/06/08 01:53:43 millert Exp $"; +static const char rcsid[] = "$OpenBSD: rmjob.c,v 1.15 2003/02/13 17:22:01 millert Exp $"; #endif #endif /* not lint */ @@ -333,6 +333,7 @@ rmremote(void) { char *cp; int i, rem; + size_t n; char buf[BUFSIZ]; if (!remote) @@ -344,18 +345,26 @@ rmremote(void) */ fflush(stdout); - (void)snprintf(buf, sizeof(buf)-2, "\5%s %s", RP, all ? "-all" : person); - cp = buf + strlen(buf); - for (i = 0; i < users && cp-buf+1+strlen(user[i]) < sizeof buf - 2; i++) { - cp += strlen(cp); + /* the trailing space will be replaced with a newline later */ + n = snprintf(buf, sizeof(buf), "\5%s %s ", RP, all ? "-all" : person); + if (n == -1 || n >= sizeof(buf)) + goto bad; + cp = buf + n; + for (i = 0; i < users; i++) { + n = strlcpy(cp, user[i], sizeof(buf) - (cp - buf + 1)); + if (n >= sizeof(buf) - (cp - buf + 1)) + goto bad; + cp += n; *cp++ = ' '; - strcpy(cp, user[i]); } - for (i = 0; i < requests && cp-buf+10 < sizeof(buf) - 2; i++) { - cp += strlen(cp); - (void)sprintf(cp, " %d", requ[i]); + *cp = '\0'; + for (i = 0; i < requests; i++) { + n = snprintf(cp, sizeof(buf) - (cp - buf), "%d ", requ[i]); + if (n == -1 || n >= sizeof(buf) - (cp - buf)) + goto bad; + cp += n; } - strcat(cp, "\n"); + cp[-1] = '\n'; /* replace space with newline, leave the NUL */ rem = getport(RM, 0); if (rem < 0) { if (from != host) @@ -380,6 +389,10 @@ rmremote(void) (void)sigaction(SIGALRM, &osa, NULL); (void)close(rem); } + return; +bad: + printf("remote buffer too large\n"); + return; } static void |