commit 6eb1f1426bfd99f88d927838d51eabc2b13e73af Author: Miroslav Lichvar Date: Thu Jan 13 17:37:47 2011 +0100 Avoid dereferencing null pointer in utmp.c. diff --git a/src/utmp.c b/src/utmp.c index aae1948..fa8b87b 100644 --- a/src/utmp.c +++ b/src/utmp.c @@ -575,7 +575,7 @@ struct win *wi; return ut_delete_user(slot, u.ut_pid, 0, 0) != 0; #endif #ifdef HAVE_UTEMPTER - if (eff_uid && wi->w_ptyfd != -1) + if (eff_uid && wi && wi->w_ptyfd != -1) { /* sigh, linux hackers made the helper functions void */ if (SLOT_USED(u)) commit 4ebd6db10c712eb56d4e61f1a8d4a41d0465ed89 Author: Miroslav Lichvar Date: Thu Jan 13 17:36:06 2011 +0100 Add more tty checks. diff --git a/src/extern.h b/src/extern.h index 2b9722e..c787d99 100644 --- a/src/extern.h +++ b/src/extern.h @@ -110,6 +110,7 @@ extern void brktty __P((int)); extern struct baud_values *lookup_baud __P((int bps)); extern int SetBaud __P((struct mode *, int, int)); extern int SttyMode __P((struct mode *, char *)); +extern int CheckTtyname __P((char *)); /* mark.c */ diff --git a/src/screen.c b/src/screen.c index 3dde3b4..cc8f565 100644 --- a/src/screen.c +++ b/src/screen.c @@ -970,8 +970,13 @@ char **av; else \ attach_tty = ""; \ } \ - else if (stat(attach_tty, &st)) \ - Panic(errno, "Cannot access '%s'", attach_tty); \ + else \ + { \ + if (stat(attach_tty, &st)) \ + Panic(errno, "Cannot access '%s'", attach_tty); \ + if (CheckTtyname(attach_tty)) \ + Panic(0, "Bad tty '%s'", attach_tty); \ + } \ if (strlen(attach_tty) >= MAXPATHLEN) \ Panic(0, "TtyName too long - sorry."); \ } while (0) diff --git a/src/tty.sh b/src/tty.sh index f2afd54..e264796 100644 --- a/src/tty.sh +++ b/src/tty.sh @@ -60,6 +60,7 @@ exit 0 #include #include #include +#include #ifndef sgi # include #endif @@ -1506,6 +1507,19 @@ int ibaud, obaud; return 0; } + +int +CheckTtyname (tty) +char *tty; +{ + struct stat st; + + if (lstat(tty, &st) || !S_ISCHR(st.st_mode) || + (st.st_nlink > 1 && strncmp(tty, "/dev/", 5))) + return -1; + return 0; +} + /* * Write out the mode struct in a readable form */ diff --git a/src/utmp.c b/src/utmp.c index afa0948..aae1948 100644 --- a/src/utmp.c +++ b/src/utmp.c @@ -361,7 +361,7 @@ RemoveLoginSlot() char *tty; debug("couln't zap slot -> do mesg n\n"); D_loginttymode = 0; - if ((tty = ttyname(D_userfd)) && stat(tty, &stb) == 0 && (int)stb.st_uid == real_uid && ((int)stb.st_mode & 0777) != 0666) + if ((tty = ttyname(D_userfd)) && stat(tty, &stb) == 0 && (int)stb.st_uid == real_uid && !CheckTtyname(tty) && ((int)stb.st_mode & 0777) != 0666) { D_loginttymode = (int)stb.st_mode & 0777; chmod(D_usertty, stb.st_mode & 0600); @@ -387,7 +387,7 @@ RestoreLoginSlot() } UT_CLOSE; D_loginslot = (slot_t)0; - if (D_loginttymode && (tty = ttyname(D_userfd))) + if (D_loginttymode && (tty = ttyname(D_userfd)) && !CheckTtyname(tty)) chmod(tty, D_loginttymode); } @@ -853,7 +853,7 @@ getlogin() for (fd = 0; fd <= 2 && (tty = ttyname(fd)) == NULL; fd++) ; - if ((tty == NULL) || ((fd = open(UTMP_FILE, O_RDONLY)) < 0)) + if ((tty == NULL) || CheckTtyname(tty) || ((fd = open(UTMP_FILE, O_RDONLY)) < 0)) return NULL; tty = stripdev(tty); retbuf[0] = '\0'; commit 8e7fcb821dc7204a27d88707284e259444671c12 Author: Miroslav Lichvar Date: Thu Jan 13 17:31:16 2011 +0100 Don't assign address of auto variable to outer scope symbol. diff --git a/src/socket.c b/src/socket.c index 940034d..7507d75 100644 --- a/src/socket.c +++ b/src/socket.c @@ -722,6 +722,7 @@ struct msg *mp; char *args[MAXARGS]; register int n; register char **pp = args, *p = mp->m.create.line; + char buf[20]; nwin = nwin_undef; n = mp->m.create.nargs; @@ -731,7 +732,6 @@ struct msg *mp; if (n) { int l, num; - char buf[20]; l = strlen(p); if (IsNumColon(p, 10, buf, sizeof(buf))) commit 2a0e0dc7e05b36f374a074f6627efece3695f8c7 Author: Miroslav Lichvar Date: Thu Jan 13 17:24:04 2011 +0100 Remove redundant if statements. diff --git a/src/braille_tsi.c b/src/braille_tsi.c index 6768291..6f84913 100644 --- a/src/braille_tsi.c +++ b/src/braille_tsi.c @@ -127,7 +127,6 @@ display_status_tsi() r = read(bd.bd_fd,ibuf,1); if (r != 1) return -1; - if (r != -1) if (ibuf[0] == 'V') r = read(bd.bd_fd, ibuf, 3); else diff --git a/src/fileio.c b/src/fileio.c index 88fbf64..bd29011 100644 --- a/src/fileio.c +++ b/src/fileio.c @@ -80,8 +80,6 @@ register char *str1, *str2; } else { - if (len1 == 0) - return 0; if ((cp = malloc((unsigned) len1 + add_colon + 1)) == NULL) Panic(0, "%s", strnomem); cp[len1 + add_colon] = '\0'; commit e75e7a0cf5319e10aae0c45e17ce70d86ef2aee8 Author: Miroslav Lichvar Date: Thu Jan 13 17:18:59 2011 +0100 Set PAM_TTY item. diff --git a/src/attacher.c b/src/attacher.c index 1fab5b2..460f1ea 100644 --- a/src/attacher.c +++ b/src/attacher.c @@ -861,6 +861,7 @@ screen_builtin_lck() #ifdef USE_PAM pam_handle_t *pamh = 0; int pam_error; + char *tty_name; #else char *pass, mypass[16 + 1], salt[3]; #endif @@ -932,6 +933,15 @@ screen_builtin_lck() pam_error = pam_start("screen", ppp->pw_name, &PAM_conversation, &pamh); if (pam_error != PAM_SUCCESS) AttacherFinit(SIGARG); /* goodbye */ + + if (strncmp(attach_tty, "/dev/", 5) == 0) + tty_name = attach_tty + 5; + else + tty_name = attach_tty; + pam_error = pam_set_item(pamh, PAM_TTY, tty_name); + if (pam_error != PAM_SUCCESS) + AttacherFinit(SIGARG); /* goodbye */ + pam_error = pam_authenticate(pamh, 0); pam_end(pamh, pam_error); PAM_conversation.appdata_ptr = 0; commit eb2e13f633f9615e9b60f19e1649f46bd07b2802 Author: Miroslav Lichvar Date: Thu Jan 13 17:16:59 2011 +0100 Check return code from setgid/setuid. diff --git a/src/attacher.c b/src/attacher.c index 370d594..1fab5b2 100644 --- a/src/attacher.c +++ b/src/attacher.c @@ -185,8 +185,8 @@ int how; if (ret == SIG_POWER_BYE) { int ppid; - setgid(real_gid); - setuid(real_uid); + if (setgid(real_gid) || setuid(real_uid)) + Panic(errno, "setuid/gid"); if ((ppid = getppid()) > 1) Kill(ppid, SIGHUP); exit(0); @@ -282,7 +282,10 @@ int how; #ifdef MULTIUSER if (!multiattach) #endif - setuid(real_uid); + { + if (setuid(real_uid)) + Panic(errno, "setuid"); + } #if defined(MULTIUSER) && defined(USE_SETEUID) else { @@ -290,7 +293,8 @@ int how; xseteuid(real_uid); /* multi_uid, allow backend to send signals */ } #endif - setgid(real_gid); + if (setgid(real_gid)) + Panic(errno, "setgid"); eff_uid = real_uid; eff_gid = real_gid; @@ -486,7 +490,8 @@ AttacherFinit SIGDEFARG #ifdef MULTIUSER if (tty_oldmode >= 0) { - setuid(own_uid); + if (setuid(own_uid)) + Panic(errno, "setuid"); chmod(attach_tty, tty_oldmode); } #endif @@ -504,11 +509,14 @@ AttacherFinitBye SIGDEFARG if (multiattach) exit(SIG_POWER_BYE); #endif - setgid(real_gid); + if (setgid(real_gid)) + Panic(errno, "setgid"); #ifdef MULTIUSER - setuid(own_uid); + if (setuid(own_uid)) + Panic(errno, "setuid"); #else - setuid(real_uid); + if (setuid(real_uid)) + Panic(errno, "setuid"); #endif /* we don't want to disturb init (even if we were root), eh? jw */ if ((ppid = getppid()) > 1) @@ -679,11 +687,14 @@ static sigret_t LockHup SIGDEFARG { int ppid = getppid(); - setgid(real_gid); + if (setgid(real_gid)) + Panic(errno, "setgid"); #ifdef MULTIUSER - setuid(own_uid); + if (setuid(own_uid)) + Panic(errno, "setuid"); #else - setuid(real_uid); + if (setuid(real_uid)) + Panic(errno, "setuid"); #endif if (ppid > 1) Kill(ppid, SIGHUP); @@ -710,11 +721,14 @@ LockTerminal() if ((pid = fork()) == 0) { /* Child */ - setgid(real_gid); + if (setgid(real_gid)) + Panic(errno, "setgid"); #ifdef MULTIUSER - setuid(own_uid); + if (setuid(own_uid)) + Panic(errno, "setuid"); #else - setuid(real_uid); /* this should be done already */ + if (setuid(real_uid)) /* this should be done already */ + Panic(errno, "setuid"); #endif closeallfiles(0); /* important: /etc/shadow may be open */ execl(prg, "SCREEN-LOCK", NULL);