Index: patches/patch-src_acl_c
===================================================================
RCS file: patches/patch-src_acl_c
diff -N patches/patch-src_acl_c
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_acl_c 20 Sep 2021 07:17:30 -0000
@@ -0,0 +1,20 @@
+$OpenBSD$
+
+Index: src/acl.c
+--- src/acl.c.orig
++++ src/acl.c
+@@ -2907,9 +2907,11 @@ for (; cb; cb = cb->next)
+ HDEBUG(D_acl)
+ {
+ int lhswidth = 0;
+- debug_printf_indent("check %s%s %n",
+- (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
+- conditions[cb->type].name, &lhswidth);
++ char *first = (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"";
++ char *second = conditions[cb->type].name;
++
++ debug_printf_indent("check %s%s ", first, second);
++ lhswidth = sizeof("check ") + strlen(first) + strlen(second);
+
+ if (cb->type == ACLC_SET)
+ {
Index: patches/patch-src_exim_c
===================================================================
RCS file: patches/patch-src_exim_c
diff -N patches/patch-src_exim_c
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_exim_c 20 Sep 2021 07:17:30 -0000
@@ -0,0 +1,20 @@
+$OpenBSD$
+
+Index: src/exim.c
+--- src/exim.c.orig
++++ src/exim.c
+@@ -4751,8 +4751,12 @@ for (i = 0;;)
+ if (amp)
+ {
+ int loffset;
+- string_format(buffer, sizeof(buffer), "%.*s%n%s%s",
+- (int)(amp - name), name, &loffset, originator_login, amp + 1);
++ char *temp = NULL;
++
++ loffset = asprintf(&temp, "%.*s", (int)(amp - name), name);
++ string_format(buffer, sizeof(buffer), "%s%s%s", temp,
++ originator_login, amp + 1);
++ free(temp);
+ buffer[loffset] = toupper(buffer[loffset]);
+ name = buffer;
+ }
Index: patches/patch-src_host_c
===================================================================
RCS file: patches/patch-src_host_c
diff -N patches/patch-src_host_c
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_host_c 20 Sep 2021 07:17:30 -0000
@@ -0,0 +1,21 @@
+$OpenBSD$
+
+Index: src/host.c
+--- src/host.c.orig
++++ src/host.c
+@@ -2587,10 +2587,13 @@ if (whichrrs & HOST_FIND_BY_SRV)
+ {
+ gstring * g;
+ uschar * temp_fully_qualified_name;
++ char *temp;
+ int prefix_length;
+
+- g = string_fmt_append(NULL, "_%s._tcp.%n%.256s",
+- srv_service, &prefix_length, host->name);
++ prefix_length = asprintf(&temp, "_%s._tcp.", srv_service);
++ g = string_fmt_append(NULL, "%s%.256s",
++ temp, host->name);
++ free(&temp);
+ temp_fully_qualified_name = string_from_gstring(g);
+ ind_type = T_SRV;
+
Index: patches/patch-src_rewrite_c
===================================================================
RCS file: patches/patch-src_rewrite_c
diff -N patches/patch-src_rewrite_c
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_rewrite_c 20 Sep 2021 07:17:30 -0000
@@ -0,0 +1,17 @@
+$OpenBSD$
+
+Index: src/rewrite.c
+--- src/rewrite.c.orig
++++ src/rewrite.c
+@@ -325,8 +325,9 @@ for (rewrite_rule * rule = rewrite_rules;
+ else
+ {
+ subject = newparsed;
+- new = string_sprintf("%.*s%s%n%s",
+- yield_start, yield, subject, &end, yield + yield_end);
++ new = string_sprintf("%.*s%s%s",
++ yield_start, yield, subject, yield + yield_end);
++ end = strlen(new) - strlen(yield + yield_end);
+ yield_end = end;
+ yield = new;
+ }
Index: patches/patch-src_spam_c
===================================================================
RCS file: patches/patch-src_spam_c
diff -N patches/patch-src_spam_c
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_spam_c 20 Sep 2021 07:17:30 -0000
@@ -0,0 +1,19 @@
+$OpenBSD$
+
+Index: src/spam.c
+--- src/spam.c.orig
++++ src/spam.c
+@@ -395,10 +395,10 @@ else
+ { /* spamassassin variant */
+ int n;
+ uschar * s = string_sprintf(
+- "REPORT SPAMC/1.2\r\nUser: %s\r\nContent-length: %ld\r\n\r\n%n",
+- user_name, mbox_size, &n);
++ "REPORT SPAMC/1.2\r\nUser: %s\r\nContent-length: %ld\r\n\r\n",
++ user_name, mbox_size);
+ /* send our request */
+- wrote = send(spamd_cctx.sock, s, n, 0);
++ wrote = send(spamd_cctx.sock, s, strlen(n), 0);
+ }
+
+ if (wrote == -1)
Index: patches/patch-src_transport_c
===================================================================
RCS file: patches/patch-src_transport_c
diff -N patches/patch-src_transport_c
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_transport_c 20 Sep 2021 07:17:30 -0000
@@ -0,0 +1,18 @@
+$OpenBSD$
+
+Index: src/transport.c
+--- src/transport.c.orig
++++ src/transport.c
+@@ -959,9 +959,9 @@ if (!(tctx->options & topt_no_headers))
+ if (tctx->options & topt_add_return_path)
+ {
+ int n;
+- uschar * s = string_sprintf("Return-path: <%.*s>\n%n",
+- EXIM_EMAILADDR_MAX, return_path, &n);
+- if (!write_chunk(tctx, s, n)) goto bad;
++ uschar * s = string_sprintf("Return-path: <%.*s>\n",
++ EXIM_EMAILADDR_MAX, return_path);
++ if (!write_chunk(tctx, s, strlen(s))) goto bad;
+ }
+
+ /* Add envelope-to: if requested */
On 9/20/21 8:26 AM, Renaud Allard wrote:
>
>
> On 9/20/21 1:13 AM, Theo de Raadt wrote:
>> Christian Weisgerber <naddy@mips.inka.de> wrote:
>>
>>> This includes the list of remaining ports with %n warnings:
>>>
>>> mail/exim
>>> net/climm
>>
>> two left.
>>
>> here is my brutish attempt to deal with exim, which has a set of
>> *printf-like functions which return pointer, and but discard the
>> length
>>
>> in a few cases, %n is at the end, allowing use of strlen() to
>> recover the discarded length
>>
>> in other cases, %n is embedded, and the operation must be split up.
>>
>> I am unable (and unwilling) to run this in test. Is there anyone who
>> can take this on?
>>
>
> I am currently testing it on my small home prod server on 6.9.
>
I have not seen any bad behaviour with the patch.
The whole test suite has also been run (on HEAD) without any major
drawback. There are a couple more failures, but I suspect they might not
be related to that patch.
So, here is the port related patch
No comments:
Post a Comment