From ac7cbd4435a4647c0e6ec1191c585144f6b5a6d9 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 20 May 2013 10:27:23 -0700 Subject: [PATCH 1/6] Check set[e]uid return code --- src/common.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/common.c b/src/common.c index fe88112..44e7a88 100644 --- a/src/common.c +++ b/src/common.c @@ -167,8 +167,9 @@ do_chroot(char *newroot) if (chroot(newroot) != 0 || chdir("/") != 0) err(1, "%s", newroot); - seteuid(geteuid()); - setuid(getuid()); + if (seteuid(geteuid()) != 0 || setuid(getuid()) != 0) { + err(1, "set[e]uid()"); + } #else warnx("chroot not available"); #endif From 2d90aaaf306cbffc06a145f26048f06e8863498d Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 20 May 2013 10:28:25 -0700 Subject: [PATCH 2/6] Wipe the whole buffer containing the DNS name, not the size of its pointer --- src/iodined.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/iodined.c b/src/iodined.c index b3b0607..8fcbe00 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -2023,7 +2023,7 @@ write_dns_nameenc(char *buf, size_t buflen, char *data, int datalen, char downen space = MIN(0xFF, buflen) - 4 - 2; /* -1 encoding type, -3 ".xy", -2 for safety */ - memset(buf, 0, sizeof(buf)); + memset(buf, 0, buflen); if (downenc == 'S') { buf[0] = 'i'; From 58dac78bd879a1f64bae2a89303e1659db687b2e Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 20 May 2013 10:30:43 -0700 Subject: [PATCH 3/6] Fix NULL pointer deref --- src/iodined.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/iodined.c b/src/iodined.c index 8fcbe00..415465a 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -1589,8 +1589,10 @@ tunnel_bind(int bind_fd, int dns_fd) /* Get sockaddr from id */ fw_query_get(id, &query); - if (!query && debug >= 2) { - fprintf(stderr, "Lost sender of id %u, dropping reply\n", (id & 0xFFFF)); + if (!query) { + if (debug >= 2) { + fprintf(stderr, "Lost sender of id %u, dropping reply\n", (id & 0xFFFF)); + } return 0; } From b31e66343a073bbc7db08f499d3b5335f4f1994c Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 20 May 2013 10:31:39 -0700 Subject: [PATCH 4/6] -R only works on OpenBSD. --- src/iodine.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/iodine.c b/src/iodine.c index 38d7159..6051895 100644 --- a/src/iodine.c +++ b/src/iodine.c @@ -136,7 +136,9 @@ main(int argc, char **argv) int lazymode; int selecttimeout; int hostname_maxlen; +#ifdef OPENBSD int rtable = 0; +#endif nameserv_addr = NULL; topdomain = NULL; @@ -200,9 +202,11 @@ main(int argc, char **argv) case 'd': device = optarg; break; +#ifdef OPENBSD case 'R': rtable = atoi(optarg); break; +#endif case 'P': strncpy(password, optarg, sizeof(password)); password[sizeof(password)-1] = 0; From 1523a4f035edb376ccb4104403f64708d6d19664 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 20 May 2013 10:39:05 -0700 Subject: [PATCH 5/6] snprintf() is a macro on some operating systems and having #ifdef statements in macro parameters has undefined behavior. --- src/tun.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/tun.c b/src/tun.c index 734557b..eb8bb48 100644 --- a/src/tun.c +++ b/src/tun.c @@ -449,6 +449,7 @@ tun_setip(const char *ip, const char *other_ip, int netbits) struct in_addr addr; DWORD len; #endif + const char *display_ip; netmask = 0; for (i = 0; i < netbits; i++) { @@ -462,15 +463,16 @@ tun_setip(const char *ip, const char *other_ip, int netbits) return 1; } #ifndef WINDOWS32 +# ifdef FREEBSD + display_ip = other_ip; /* FreeBSD wants other IP as second IP */ +# else + display_ip = ip; +# endif snprintf(cmdline, sizeof(cmdline), IFCONFIGPATH "ifconfig %s %s %s netmask %s", if_name, ip, -#ifdef FREEBSD - other_ip, /* FreeBSD wants other IP as second IP */ -#else - ip, -#endif + display_ip, inet_ntoa(net)); fprintf(stderr, "Setting IP of %s to %s\n", if_name, ip); From 28ceecba37635486fafa6050336dc297f4bdb3a2 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 20 May 2013 10:40:44 -0700 Subject: [PATCH 6/6] size_t values can't be negative. --- src/read.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/src/read.c b/src/read.c index ff40382..f4ad4a8 100644 --- a/src/read.c +++ b/src/read.c @@ -115,9 +115,6 @@ readlong(char *packet, char **src, uint32_t *dst) int readdata(char *packet, char **src, char *dst, size_t len) { - if (len < 0) - return 0; - memcpy(dst, *src, len); (*src) += len; @@ -232,9 +229,6 @@ putlong(char **dst, uint32_t value) int putdata(char **dst, char *data, size_t len) { - if (len < 0) - return 0; - memcpy(*dst, data, len); (*dst) += len;