Ticket History #648: rlogin dumps core at high tty speeds

From ghudson@MIT.EDU Sun Oct 25 15:27:15 1998
Received: from MIT.EDU (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.69.0.28]) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id PAA22021 for <bugs@RT-11.MIT.EDU>; Sun, 25 Oct 1998 15:27:14 -0500
Received: from SMALL-GODS.MIT.EDU by MIT.EDU with SMTP
id AA08533; Sun, 25 Oct 98 15:27:15 EST
Received: by small-gods.mit.edu (SMI-8.6/4.7) id PAA29926; Sun, 25 Oct 1998 15:27:12 -0500
Message-Id: <199810252027.PAA29926@small-gods.mit.edu>
Date: Sun, 25 Oct 1998 15:27:12 -0500
From: ghudson@MIT.EDU
Reply-To: ghudson@MIT.EDU
To: krb5-bugs@MIT.EDU
Subject: rlogin speed-handling
X-Send-Pr-Version: 3.99

MIT

System: SunOS small-gods.mit.edu 5.6 Generic_105181-05 sun4u sparc SUNW,Ultra-5_10
Architecture: sun4

rlogin dumps core if the tty speed is over 38400.
stty 115200
rlogin somewhere
This rewrite of the affected code mirrors the code in login.c. In particular,
the arrays are borrowed from that file.

Index: krlogin.c
===================================================================
RCS file: /afs/dev.mit.edu/source/repository/third/krb5/src/appl/bsd/krlogin.c,v
retrieving revision 1.3
diff -c -r1.3 krlogin.c
*** krlogin.c 1998/06/17 17:43:19 1.3
--- krlogin.c 1998/10/25 19:36:39
***************
*** 188,205 ****
the original characteristics */
int confirm = 0; /* ask if ~. is given before dying. */
int litout;
- #if defined(hpux) || defined(__hpux)
- char *speeds[] =
- { "0", "50", "75", "110", "134", "150", "200", "300", "600",
- "900", "1200", "1800", "2400", "3600", "4800", "7200", "9600",
- "19200", "38400", "EXTA", "EXTB" };
- #else
- char *speeds[] =
- { "0", "50", "75", "110", "134", "150", "200", "300",
- "600", "1200", "1800", "2400", "4800", "9600", "19200", "38400" };
- #endif
char term[256] = "network";

#ifndef POSIX_SIGNALS
#ifndef sigmask
#define sigmask(m) (1 << ((m)-1))
--- 188,209 ----
the original characteristics */
int confirm = 0; /* ask if ~. is given before dying. */
int litout;
char term[256] = "network";

+ char *speeds[] = {
+ "0", "50", "75", "110", "134", "150", "200", "300", "600",
+ "1200", "1800", "2400", "4800", "9600", "19200", "38400",
+ };
+ #define NSPEEDS (sizeof(speeds) / sizeof(speeds[0]))
+
+ #ifdef POSIX_TERMIOS
+ /* this must be in sync with the list above */
+ speed_t b_speeds[] = {
+ B0, B50, B75, B110, B134, B150, B200, B300, B600,
+ B1200, B1800, B2400, B4800, B9600, B19200, B38400,
+ };
+ #endif
+
#ifndef POSIX_SIGNALS
#ifndef sigmask
#define sigmask(m) (1 << ((m)-1))
***************
*** 504,526 ****
(void) strcpy(term, cp);
#ifdef POSIX_TERMIOS
if (tcgetattr(0, &ttyb) == 0) {
! int ospeed = cfgetospeed (&ttyb);

! (void) strcat(term, "/");
! if (ospeed >= 50)
! /* On some systems, ospeed is the baud rate itself,
! not a table index. */
! sprintf (term + strlen (term), "%d", ospeed);
! else {
! (void) strcat(term, speeds[ospeed]);
! #if 0
! /* XXX - Not used, since the above code was
! * not ifdef'd and it relied on cfget... */
!
! /* some "posix" systems don't have cfget...
! * so used CBAUD if it's there */
! (void) strcat(term, speeds[ttyb.c_cflag & CBAUD]);
! #endif
}
}
#else
--- 508,521 ----
(void) strcpy(term, cp);
#ifdef POSIX_TERMIOS
if (tcgetattr(0, &ttyb) == 0) {
! int i;
! speed_t ospeed = cfgetospeed (&ttyb);

! for (i = 0; i < NSPEEDS; i++) {
! if (b_speeds[i] == ospeed) {
! sprintf(term + strlen(term), "/%d", speeds[i]);
! break;
! }
}
}
#else

From mbusse@arl.mil Mon Mar 15 17:59:12 1999
Received: from MIT.EDU (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.69.0.28]) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id RAA13390 for <bugs@RT-11.MIT.EDU>; Mon, 15 Mar 1999 17:59:07 -0500
Received: from blaze.arl.mil by MIT.EDU with SMTP
id AA06541; Mon, 15 Mar 99 17:59:49 EST
Received: from blaze.arl.mil by blaze.arl.mil id aa15245; 15 Mar 1999 17:54 EST
Message-Id: <Pine.GSO.3.95.990315172717.13812A-100000@blaze.arl.mil>
Date: Mon, 15 Mar 1999 17:54:03 -0500 (EST)
From: Mike Busse <mbusse@arl.mil>
To: krb5-bugs@MIT.EDU
Subject: Krb5 + CDE + Solaris = core

Hi,
I thought I'd email you about a problem we had with CDE running
Solaris 2.5.1 and up, along with krb5 v1.5. The function used in
krb5/src/appl/bsd/krlogin.c: cfgetospeed line returns an index value
of 29, where the array only goes to 16. 24 is defined in Solaris'
/usr/include/sys/termios.h.
The fix:

blaze /src/krb5/src/appl/bsd 5 # diff -c krlogin.c krlogin.c.orig
*** krlogin.c Mon Mar 8 18:59:14 1999
--- krlogin.c.orig Sat Oct 24 11:04:06 1998
***************
*** 208,223 ****
#else
char *speeds[] =
{ "0", "50", "75", "110", "134", "150", "200", "300",
! "600", "1200", "1800", "2400", "4800", "9600", "19200", "38400",
! "57600", "76800", "115200", "153600", "230400", "307200", "460800" };
#endif
char term[256] = "network";

- #if defined(hpux) || defined(__hpux)
#define MAX_SPEED_LENGTH (sizeof("38400") - 1)
- #else
- #define MAX_SPEED_LENGTH (sizeof("460800") - 1)
- #endif /* MAX_SPEED_LENGTH */
#define MAX_TERM_LENGTH (sizeof(term) - 1 - MAX_SPEED_LENGTH - 1)

#ifndef POSIX_SIGNALS
--- 208,218 ----
#else
char *speeds[] =
{ "0", "50", "75", "110", "134", "150", "200", "300",
! "600", "1200", "1800", "2400", "4800", "9600", "19200", "38400" };
#endif
char term[256] = "network";

#define MAX_SPEED_LENGTH (sizeof("38400") - 1)
#define MAX_TERM_LENGTH (sizeof(term) - 1 - MAX_SPEED_LENGTH - 1)

#ifndef POSIX_SIGNALS
***************
*** 527,534 ****
#ifdef POSIX_TERMIOS
if (tcgetattr(0, &ttyb) == 0) {
int ospeed = cfgetospeed (&ttyb);
- if ( ospeed > MAX_SPEED_LENGTH )
- ospeed = MAX_SPEED_LENGTH;

(void) strcat(term, "/");
if (ospeed >= 50)
--- 522,527 ----

*** The most important line here is:
- if ( ospeed > MAX_SPEED_LENGTH )
- ospeed = MAX_SPEED_LENGTH;

Mike.

-----------------------------------------------------------------------------
Michael H. Busse Email: mbusse@arl.mil
ARL/CICC/ARD/SAB/USAT Vmail: 410-278-0615
Business Plus Corporation Smail: U.S. Army Research Laboratory
Contractor ATTN: AMSRL-CI-AS (M. Busse - B328, Rm15)
#include <stddisclm.h> Aberdeen Proving Ground, MD 21005-5067
-----------------------------------------------------------------------------


Responsible-Changed-From-To: gnats-admin->krb5-unassigned
Responsible-Changed-By: raeburn
Responsible-Changed-When: Thu Jul 5 20:56:00 2001
Responsible-Changed-Why:
reformat