[src/netbsd-1-4]: src/usr.sbin/xntp/xntpd Apply patch (requested by itojun):

[he <he%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/1a192233ce2b
branches:  netbsd-1-4
changeset: 471292:1a192233ce2b
user:      he <he%NetBSD.org@localhost>
date:      Sat May 26 14:44:37 2001 +0000

description:
Apply patch (requested by itojun):
  Avoid underrun, and fix the fact that the previous fix was one byte
  too restrictive.
  Pulled from revisions 1.3-1.4 of dist/ntp/ntpd/ntp_control.c.

diffstat:

 usr.sbin/xntp/xntpd/ntp_control.c |  7 +++----
 1 files changed, 3 insertions(+), 4 deletions(-)

diffs (28 lines):

diff -r 7aa95c8602df -r 1a192233ce2b usr.sbin/xntp/xntpd/ntp_control.c
--- a/usr.sbin/xntp/xntpd/ntp_control.c Sat Apr 14 21:20:27 2001 +0000
+++ b/usr.sbin/xntp/xntpd/ntp_control.c Sat May 26 14:44:37 2001 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ntp_control.c,v 1.6.2.1 2001/04/05 12:15:57 he Exp $   */
+/*     $NetBSD: ntp_control.c,v 1.6.2.2 2001/05/26 14:44:37 he Exp $   */
 
 /*
  * ntp_control.c - respond to control messages and send async traps
@@ -1759,8 +1759,7 @@
                                                cp++;
                                        while (cp < reqend && *cp != ',') {
                                                *tp++ = *cp++;
-                                               if (tp >=
-                                                   buf + sizeof(buf) - 1) {
+                                               if (tp >= buf + sizeof(buf)) {
 #if 0  /* don't syslog for now - DoS potential on filling syslog */
                                                        msyslog(LOG_WARNING,
     "Attempted \"ntpdx\" exploit from IP %d.%d.%d.%d:%d (possibly spoofed)\n",
@@ -1776,7 +1775,7 @@
                                        if (cp < reqend)
                                                cp++;
                                        *tp = '\0';
-                                       while (isspace(*(tp-1)))
+                                       while (tp > buf && isspace((int)*(tp-1)))
                                                *(--tp) = '\0';
                                        reqpt = cp;
                                        *data = buf;