Ticket History #533: PATCH: krb-1.0.4 util/pty

From opusl@whatmore.Stanford.EDU Fri Jan 23 20:22:53 1998
Received: from MIT.EDU (SOUTH-STATION-ANNEX.MIT.EDU [18.72.1.2]) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id UAA09310 for <bugs@RT-11.MIT.EDU>; Fri, 23 Jan 1998 20:22:53 -0500
Received: from whatmore.Stanford.EDU by MIT.EDU with SMTP
id AA08011; Fri, 23 Jan 98 20:22:51 EST
Received: (from opusl@localhost)
by whatmore.Stanford.EDU (8.8.8/8.8.8) id RAA29488;
Fri, 23 Jan 1998 17:22:41 -0800 (PST)
Message-Id: <199801240122.RAA29488@whatmore.Stanford.EDU>
Date: Fri, 23 Jan 1998 17:22:41 -0800 (PST)
From: Larry Schwimmer <opusl@whatmore.Stanford.EDU>
To: krb5-bugs@MIT.EDU
Cc: schwim@leland.stanford.edu
Subject: PATCH: krb-1.0.4 util/pty


State-Changed-From-To: open-closed
State-Changed-By: tlyu
State-Changed-When: Mon Jan 26 23:50:28 1998
State-Changed-Why:

Already fixed in our sources. The 1.0.5 patch release (due out soon)
should deal with this problem and others.

Submitter-Id: net
Originator: Larry Schwimmer
Confidential: no
Synopsis:
Severity: serious
Category: krb5-libs
Class: sw-bug
Release: krb5-1.0.4
Environment:

HP-UX, Linux

Description:

1.0.4 made some changes to getpty.c, and the code was
unfortunately changed to perform a needless optimization. strlen was
substituted with sizeof; they are not equivalent.

How-To-Repeat:

Compile 1.0.4. Install telnetd or klogind. Watch connections
fail with an unable to allocate pty error.

Fix:

This reverts the 1.0.4 patch. Using "sizeof(string) - 1"
instead of strlen(string) would probably also work, but just reverting
seemed safe. The CPU time required to compute the length of a nine
byte string should be tolerable on today's machines. (-:

--- util/pty/getpty.c.orig Thu Dec 11 14:10:46 1997
+++ util/pty/getpty.c Sat Jan 17 14:26:27 1998
***************
*** 111,118 ****
} else {
for (cp = "pqrstuvwxyzPQRST";*cp; cp++) {
sprintf(slavebuf,"/dev/ptyXX");
- slavebuf[sizeof("/dev/pty")] = *cp;
- slavebuf[sizeof("/dev/ptyp")] = '0';
if (stat(slavebuf, &stb) < 0)
break;
for (i = 0; i < 16; i++) {
--- 111,118 ----
} else {
for (cp = "pqrstuvwxyzPQRST";*cp; cp++) {
sprintf(slavebuf,"/dev/ptyXX");
+ slavebuf[strlen("/dev/pty")] = *cp;
+ slavebuf[strlen("/dev/ptyp")] = '0';
if (stat(slavebuf, &stb) < 0)
break;
for (i = 0; i < 16; i++) {