[src/netbsd-1-5]: src/dist/ntp/ntpd Pull up revisions 1.3-1.4 (requested by i...

[he <he%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/7feb134947ca
branches:  netbsd-1-5
changeset: 491284:7feb134947ca
user:      he <he%NetBSD.org@localhost>
date:      Sat Apr 21 20:38:55 2001 +0000

description:
Pull up revisions 1.3-1.4 (requested by itojun):
  Avoid underrun.  Overrun check was one byte too restrictive, fix.

diffstat:

 dist/ntp/ntpd/ntp_control.c |  7 +++----
 1 files changed, 3 insertions(+), 4 deletions(-)

diffs (28 lines):

diff -r b46bbd54e786 -r 7feb134947ca dist/ntp/ntpd/ntp_control.c
--- a/dist/ntp/ntpd/ntp_control.c       Sat Apr 21 20:29:23 2001 +0000
+++ b/dist/ntp/ntpd/ntp_control.c       Sat Apr 21 20:38:55 2001 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ntp_control.c,v 1.1.1.2.4.1 2001/04/05 09:45:27 jhawk Exp $    */
+/*     $NetBSD: ntp_control.c,v 1.1.1.2.4.2 2001/04/21 20:38:55 he Exp $       */
 
 /*
  * ntp_control.c - respond to control messages and send async traps
@@ -1814,8 +1814,7 @@
                                                cp++;
                                        while (cp < reqend && *cp != ',') {
                                                *tp++ = *cp++;
-                                               if (tp >=
-                                                   buf + sizeof(buf) - 1) {
+                                               if (tp >= buf + sizeof(buf)) {
 #if 0  /* don't syslog for now - DoS potential on filling syslog */
                                                        msyslog(LOG_WARNING,
     "Attempted \"ntpdx\" exploit from IP %d.%d.%d.%d:%d (possibly spoofed)\n",
@@ -1831,7 +1830,7 @@
                                        if (cp < reqend)
                                                cp++;
                                        *tp = '\0';
-                                       while (isspace((int)(*(tp-1))))
+                                       while (tp > buf && isspace((int)(*(tp-1))))
                                                *(--tp) = '\0';
                                        reqpt = cp;
                                        *data = buf;