This commit was generated by cvs2svn to compensate for changes in r18366,

which included commits to RCS files with non-trunk default branches.

11 files changed, 179 insertions, 124 deletions

diff --git a/usr.sbin/sendmail/RELEASE_NOTES b/usr.sbin/sendmail/RELEASE_NOTES
index 7f212ec..a4dacea 100644
--- a/usr.sbin/sendmail/RELEASE_NOTES
+++ b/usr.sbin/sendmail/RELEASE_NOTES
@@ -1,11 +1,21 @@
 			SENDMAIL RELEASE NOTES
-	     @(#)RELEASE_NOTES	8.7.5.1 (Berkeley) 3/4/96
+	     @(#)RELEASE_NOTES	8.7.6.4 (Berkeley) 9/16/96
 
 
 This listing shows the version of the sendmail binary, the version
 of the sendmail configuration files, the date of release, and a
 summary of the changes in that release.
 
+8.7.6/8.7.3	96/09/17
+	SECURITY: It is possible to force getpwuid to fail when writing the
+		queue file, causing sendmail to fall back to running programs
+		as the default user.  This is not exploitable from off-site.
+		Workarounds include using a unique user for the DefaultUser
+		(old u & g options) and using smrsh as the local shell.
+	SECURITY: fix some buffer overruns; in at least one case this allows
+		a local user to get root.  This is not known to be exploitable
+		from off-site.  The workaround is to disable chfn(1) commands.
+
 8.7.5/8.7.3	96/03/04
 	Fix glitch in 8.7.4 when putting certain internal lines; this can
 		in some case cause connections to hang.  Patch from Eric
diff --git a/usr.sbin/sendmail/src/alias.c b/usr.sbin/sendmail/src/alias.c
index 2bc4487..62b6af9 100644
--- a/usr.sbin/sendmail/src/alias.c
+++ b/usr.sbin/sendmail/src/alias.c
@@ -35,7 +35,7 @@
 # include "sendmail.h"
 
 #ifndef lint
-static char sccsid[] = "@(#)alias.c	8.52 (Berkeley) 10/28/95";
+static char sccsid[] = "@(#)alias.c	8.52.1.3 (Berkeley) 9/16/96";
 #endif /* not lint */
 
 
@@ -77,7 +77,7 @@ alias(a, sendq, aliaslevel, e)
 	int naliases;
 	char *owner;
 	auto int stat = EX_OK;
-	char obuf[MAXNAME + 6];
+	char obuf[MAXNAME + 7];
 	extern char *aliaslookup();
 
 	if (tTd(27, 1))
@@ -147,7 +147,8 @@ alias(a, sendq, aliaslevel, e)
 	*/
 
 	(void) strcpy(obuf, "owner-");
-	if (strncmp(a->q_user, "owner-", 6) == 0)
+	if (strncmp(a->q_user, "owner-", 6) == 0 ||
+	    strlen(a->q_user) > (SIZE_T) sizeof obuf - 7)
 		(void) strcat(obuf, "owner");
 	else
 		(void) strcat(obuf, a->q_user);
@@ -258,7 +259,7 @@ setalias(spec)
 				return;
 			}
 		}
-		(void) sprintf(buf, "Alias%d", NAliasFileMaps);
+		(void) snprintf(buf, sizeof buf, "Alias%d", NAliasFileMaps);
 		s = stab(buf, ST_MAP, ST_ENTER);
 		map = &s->s_map;
 		bzero(map, sizeof *map);
@@ -397,9 +398,8 @@ aliaswait(map, ext, isopen)
 		return isopen;
 	}
 	mtime = stb.st_mtime;
-	(void) strcpy(buf, map->map_file);
-	if (ext != NULL)
-		(void) strcat(buf, ext);
+	snprintf(buf, sizeof buf, "%s%s",
+		map->map_file, ext == NULL ? "" : ext);
 	if (stat(buf, &stb) < 0 || stb.st_mtime < mtime || attimeout)
 	{
 		/* database is out of date */
@@ -507,8 +507,6 @@ rebuildaliases(map, automatic)
 		return;
 	}
 
-	/* avoid denial-of-service attacks */
-	resetlimits();
 	oldsigint = setsignal(SIGINT, SIG_IGN);
 	oldsigquit = setsignal(SIGQUIT, SIG_IGN);
 #ifdef SIGTSTP
diff --git a/usr.sbin/sendmail/src/arpadate.c b/usr.sbin/sendmail/src/arpadate.c
index f676470..b207654 100644
--- a/usr.sbin/sendmail/src/arpadate.c
+++ b/usr.sbin/sendmail/src/arpadate.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)arpadate.c	8.4 (Berkeley) 4/21/95";
+static char sccsid[] = "@(#)arpadate.c	8.4.1.1 (Berkeley) 9/16/96";
 #endif /* not lint */
 
 # include "sendmail.h"
@@ -208,7 +208,7 @@ arpadate(ud)
 		{
 			*q++ = ' ';
 			*q++ = '(';
-			while (*tz != '\0')
+			while (*tz != '\0' && q < &b[sizeof b - 3])
 				*q++ = *tz++;
 			*q++ = ')';
 		}
diff --git a/usr.sbin/sendmail/src/convtime.c b/usr.sbin/sendmail/src/convtime.c
index f978e92..adc38f7 100644
--- a/usr.sbin/sendmail/src/convtime.c
+++ b/usr.sbin/sendmail/src/convtime.c
@@ -33,12 +33,10 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)convtime.c	8.4 (Berkeley) 5/19/95";
+static char sccsid[] = "@(#)convtime.c	8.4.1.1 (Berkeley) 9/16/96";
 #endif /* not lint */
 
-# include <ctype.h>
-# include <string.h>
-# include "useful.h"
+# include "sendmail.h"
 
 /*
 **  CONVTIME -- convert time
@@ -165,37 +163,38 @@ pintvl(intvl, brief)
 	{
 		if (dy > 0)
 		{
-			(void) sprintf(p, "%d+", dy);
+			(void) snprintf(p, SPACELEFT(buf, p), "%d+", dy);
 			p += strlen(p);
 		}
-		(void) sprintf(p, "%02d:%02d:%02d", hr, mi, se);
+		(void) snprintf(p, SPACELEFT(buf, p), "%02d:%02d:%02d",
+			hr, mi, se);
 		return (buf);
 	}
 
 	/* use the verbose form */
 	if (wk > 0)
 	{
-		(void) sprintf(p, ", %d week%s", wk, PLURAL(wk));
+		(void) snprintf(p, SPACELEFT(buf, p), ", %d week%s", wk, PLURAL(wk));
 		p += strlen(p);
 	}
 	if (dy > 0)
 	{
-		(void) sprintf(p, ", %d day%s", dy, PLURAL(dy));
+		(void) snprintf(p, SPACELEFT(buf, p), ", %d day%s", dy, PLURAL(dy));
 		p += strlen(p);
 	}
 	if (hr > 0)
 	{
-		(void) sprintf(p, ", %d hour%s", hr, PLURAL(hr));
+		(void) snprintf(p, SPACELEFT(buf, p), ", %d hour%s", hr, PLURAL(hr));
 		p += strlen(p);
 	}
 	if (mi > 0)
 	{
-		(void) sprintf(p, ", %d minute%s", mi, PLURAL(mi));
+		(void) snprintf(p, SPACELEFT(buf, p), ", %d minute%s", mi, PLURAL(mi));
 		p += strlen(p);
 	}
 	if (se > 0)
 	{
-		(void) sprintf(p, ", %d second%s", se, PLURAL(se));
+		(void) snprintf(p, SPACELEFT(buf, p), ", %d second%s", se, PLURAL(se));
 		p += strlen(p);
 	}
 
diff --git a/usr.sbin/sendmail/src/envelope.c b/usr.sbin/sendmail/src/envelope.c
index 4bf7ac2..a22f73c 100644
--- a/usr.sbin/sendmail/src/envelope.c
+++ b/usr.sbin/sendmail/src/envelope.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)envelope.c	8.76 (Berkeley) 11/11/95";
+static char sccsid[] = "@(#)envelope.c	8.76.1.2 (Berkeley) 9/16/96";
 #endif /* not lint */
 
 #include "sendmail.h"
@@ -179,7 +179,7 @@ dropenvelope(e)
 		/* nothing to do */ ;
 	else if (curtime() > e->e_ctime + TimeOuts.to_q_return[e->e_timeoutclass])
 	{
-		(void) sprintf(buf, "Cannot send message for %s",
+		(void) snprintf(buf, sizeof buf, "Cannot send message for %s",
 			pintvl(TimeOuts.to_q_return[e->e_timeoutclass], FALSE));
 		if (e->e_message != NULL)
 			free(e->e_message);
@@ -223,7 +223,7 @@ dropenvelope(e)
 		    (strlen(e->e_from.q_paddr) <= (SIZE_T) 8 ||
 		     strcasecmp(&e->e_from.q_paddr[strlen(e->e_from.q_paddr) - 8], "-request") != 0))
 		{
-			(void) sprintf(buf,
+			(void) snprintf(buf, sizeof buf,
 				"Warning: could not send message for past %s",
 				pintvl(TimeOuts.to_q_warning[e->e_timeoutclass], FALSE));
 			if (e->e_message != NULL)
@@ -452,11 +452,11 @@ initsys(e)
 	*/
 
 	/* process id */
-	(void) sprintf(pbuf, "%d", getpid());
+	(void) snprintf(pbuf, sizeof pbuf, "%d", getpid());
 	define('p', newstr(pbuf), e);
 
 	/* hop count */
-	(void) sprintf(cbuf, "%d", e->e_hopcount);
+	(void) snprintf(cbuf, sizeof cbuf, "%d", e->e_hopcount);
 	define('c', newstr(cbuf), e);
 
 	/* time as integer, unix time, arpa time */
@@ -471,7 +471,7 @@ initsys(e)
 		{
 			if (strrchr(p, '/') != NULL)
 				p = strrchr(p, '/') + 1;
-			(void) strcpy(ybuf, p);
+			snprintf(ybuf, sizeof ybuf, "%s", p);
 			define('y', ybuf, e);
 		}
 	}
@@ -504,7 +504,7 @@ settime(e)
 
 	now = curtime();
 	tm = gmtime(&now);
-	(void) sprintf(tbuf, "%04d%02d%02d%02d%02d", tm->tm_year + 1900,
+	(void) snprintf(tbuf, sizeof tbuf, "%04d%02d%02d%02d%02d", tm->tm_year + 1900,
 			tm->tm_mon+1, tm->tm_mday, tm->tm_hour, tm->tm_min);
 	define('t', newstr(tbuf), e);
 	(void) strcpy(dbuf, ctime(&now));
@@ -686,7 +686,7 @@ setsender(from, e, delimptr, internal)
 
 				if (host == NULL)
 					host = MyHostName;
-				(void) sprintf(ebuf, "%.*s@%.*s",
+				(void) snprintf(ebuf, sizeof ebuf, "%.*s@%.*s",
 					MAXNAME, realname,
 					MAXNAME, host);
 				p = ebuf;
@@ -777,7 +777,7 @@ setsender(from, e, delimptr, internal)
 			    strcmp(pw->pw_name, e->e_from.q_user) == 0 &&
 			    !internal)
 			{
-				buildfname(pw->pw_gecos, e->e_from.q_user, buf);
+				buildfname(pw->pw_gecos, e->e_from.q_user, buf, sizeof buf);
 				if (buf[0] != '\0')
 					FullName = newstr(buf);
 			}
diff --git a/usr.sbin/sendmail/src/err.c b/usr.sbin/sendmail/src/err.c
index 241a486..c231ef1 100644
--- a/usr.sbin/sendmail/src/err.c
+++ b/usr.sbin/sendmail/src/err.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)err.c	8.42 (Berkeley) 11/29/95";
+static char sccsid[] = "@(#)err.c	8.42.1.2 (Berkeley) 9/16/96";
 #endif /* not lint */
 
 # include "sendmail.h"
@@ -137,7 +137,7 @@ syserr(fmt, va_alist)
 	else
 	{
 		uname = ubuf;
-		sprintf(ubuf, "UID%d", getuid());
+		snprintf(ubuf, sizeof ubuf, "UID%d", getuid());
 	}
 
 	if (LogLevel > 0)
@@ -218,7 +218,7 @@ usrerr(fmt, va_alist)
 		{
 			char buf[MAXLINE];
 
-			sprintf(buf, "Postmaster warning: %.*s",
+			snprintf(buf, sizeof buf, "Postmaster warning: %.*s",
 				sizeof buf - 22, MsgBuf + 4);
 			CurEnv->e_message = newstr(buf);
 		}
@@ -394,7 +394,7 @@ putoutmsg(msg, holdmsg, heldmsg)
 	{
 		/* save for possible future display */
 		msg[0] = msgcode;
-		strcpy(HeldMessageBuf, msg);
+		snprintf(HeldMessageBuf, sizeof HeldMessageBuf, "%s", msg);
 		return;
 	}
 
@@ -511,7 +511,7 @@ fmtmsg(eb, to, num, eno, fmt, ap)
 		del = '-';
 	else
 		del = ' ';
-	(void) sprintf(eb, "%3.3s%c", num, del);
+	(void) snprintf(eb, spaceleft, "%3.3s%c", num, del);
 	eb += 4;
 	spaceleft -= 4;
 
@@ -600,6 +600,7 @@ errstring(errnum)
 	int errnum;
 {
 	char *dnsmsg;
+	char *bp;
 	static char buf[MAXLINE];
 # ifndef ERRLIST_PREDEFINED
 	extern char *sys_errlist[];
@@ -621,30 +622,33 @@ errstring(errnum)
 # if defined(DAEMON) && defined(ETIMEDOUT)
 	  case ETIMEDOUT:
 	  case ECONNRESET:
-		(void) strcpy(buf, sys_errlist[errnum]);
+		bp = buf;
+		snprintf(bp, SPACELEFT(buf, bp), "%s", sys_errlist[errnum]);
+		bp += strlen(buf);
 		if (SmtpPhase != NULL)
 		{
-			(void) strcat(buf, " during ");
-			(void) strcat(buf, SmtpPhase);
+			snprintf(bp, SPACELEFT(buf, bp), " during %s",
+				SmtpPhase);
+			bp += strlen(bp);
 		}
 		if (CurHostName != NULL)
 		{
-			(void) strcat(buf, " with ");
-			(void) strcat(buf, CurHostName);
+			snprintf(bp, SPACELEFT(buf, bp), " with %s",
+				shortenstring(CurHostName, 203));
 		}
 		return (buf);
 
 	  case EHOSTDOWN:
 		if (CurHostName == NULL)
 			break;
-		(void) sprintf(buf, "Host %s is down",
+		(void) snprintf(buf, sizeof buf, "Host %s is down",
 			shortenstring(CurHostName, 203));
 		return (buf);
 
 	  case ECONNREFUSED:
 		if (CurHostName == NULL)
 			break;
-		(void) sprintf(buf, "Connection refused by %s",
+		(void) snprintf(buf, sizeof buf, "Connection refused by %s",
 			shortenstring(CurHostName, 203));
 		return (buf);
 # endif
@@ -677,19 +681,22 @@ errstring(errnum)
 
 	if (dnsmsg != NULL)
 	{
-		(void) strcpy(buf, "Name server: ");
+		bp = buf;
+		strcpy(bp, "Name server: ");
+		bp += strlen(bp);
 		if (CurHostName != NULL)
 		{
-			(void) strcat(buf, CurHostName);
-			(void) strcat(buf, ": ");
+			snprintf(bp, SPACELEFT(buf, bp), "%s: ",
+				shortenstring(CurHostName, 203));
+			bp += strlen(bp);
 		}
-		(void) strcat(buf, dnsmsg);
+		snprintf(bp, SPACELEFT(buf, bp), "%s", dnsmsg);
 		return buf;
 	}
 
 	if (errnum > 0 && errnum < sys_nerr)
 		return (sys_errlist[errnum]);
 
-	(void) sprintf(buf, "Error %d", errnum);
+	(void) snprintf(buf, sizeof buf, "Error %d", errnum);
 	return (buf);
 }
diff --git a/usr.sbin/sendmail/src/map.c b/usr.sbin/sendmail/src/map.c
index 23060d0..13d38ce 100644
--- a/usr.sbin/sendmail/src/map.c
+++ b/usr.sbin/sendmail/src/map.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)map.c	8.108 (Berkeley) 11/29/95";
+static char sccsid[] = "@(#)map.c	8.108.1.2 (Berkeley) 9/16/96";
 #endif /* not lint */
 
 #include "sendmail.h"
@@ -99,7 +99,7 @@ static char sccsid[] = "@(#)map.c	8.108 (Berkeley) 11/29/95";
 #define EX_NOTFOUND	EX_NOHOST
 
 extern bool	aliaswait __P((MAP *, char *, int));
-extern bool	extract_canonname __P((char *, char *, char[]));
+extern bool	extract_canonname __P((char *, char *, char[], int));
 
 #if defined(O_EXLOCK) && HASFLOCK
 # define LOCK_ON_OPEN	1	/* we can open/create a locked file */
@@ -647,6 +647,7 @@ getcanonname(host, hbsize, trymx)
 **		name -- the name against which to match.
 **		line -- the /etc/hosts line.
 **		cbuf -- the location to store the result.
+**		cbuflen -- the size of cbuf.
 **
 **	Returns:
 **		TRUE -- if the line matched the desired name.
@@ -654,17 +655,20 @@ getcanonname(host, hbsize, trymx)
 */
 
 bool
-extract_canonname(name, line, cbuf)
+extract_canonname(name, line, cbuf, cbuflen)
 	char *name;
 	char *line;
 	char cbuf[];
+	int cbuflen;
 {
 	int i;
 	char *p;
 	bool found = FALSE;
-	extern char *get_column();
+	int l;
+	extern char *get_column __P((char *, int, char, char *, int));
 
 	cbuf[0] = '\0';
+	l = cbuflen;
 	if (line[0] == '#')
 		return FALSE;
 
@@ -672,12 +676,14 @@ extract_canonname(name, line, cbuf)
 	{
 		char nbuf[MAXNAME + 1];
 
-		p = get_column(line, i, '\0', nbuf);
+		p = get_column(line, i, '\0', nbuf, sizeof nbuf);
 		if (p == NULL)
 			break;
 		if (cbuf[0] == '\0' ||
 		    (strchr(cbuf, '.') == NULL && strchr(p, '.') != NULL))
-			strcpy(cbuf, p);
+		{
+			snprintf(cbuf, cbuflen, "%s", p);
+		}
 		if (strcasecmp(name, p) == 0)
 			found = TRUE;
 	}
@@ -687,7 +693,7 @@ extract_canonname(name, line, cbuf)
 		char *domain = macvalue('m', CurEnv);
 
 		if (domain != NULL &&
-		    strlen(domain) + strlen(cbuf) + 1 < MAXNAME)
+		    strlen(domain) + strlen(cbuf) + 1 < cbuflen)
 		{
 			p = &cbuf[strlen(cbuf)];
 			*p++ = '.';
@@ -746,8 +752,8 @@ ndbm_map_open(map, mode)
 		char dirfile[MAXNAME + 1];
 		char pagfile[MAXNAME + 1];
 
-		sprintf(dirfile, "%s.dir", map->map_file);
-		sprintf(pagfile, "%s.pag", map->map_file);
+		snprintf(dirfile, sizeof dirfile, "%s.dir", map->map_file);
+		snprintf(pagfile, sizeof pagfile, "%s.pag", map->map_file);
 		dirfd = open(dirfile, mode|O_CREAT, DBMMODE);
 		pagfd = open(pagfile, mode|O_CREAT, DBMMODE);
 
@@ -924,7 +930,8 @@ ndbm_map_store(map, lhs, rhs)
 					bufsiz = data.dsize + old.dsize + 2;
 					buf = xalloc(bufsiz);
 				}
-				sprintf(buf, "%s,%s", data.dptr, old.dptr);
+				snprintf(buf, bufsiz, "%s,%s",
+					data.dptr, old.dptr);
 				data.dsize = data.dsize + old.dsize + 1;
 				data.dptr = buf;
 				if (tTd(38, 9))
@@ -961,7 +968,7 @@ ndbm_map_close(map)
 
 		if (strstr(map->map_file, "/yp/") != NULL)
 		{
-			(void) sprintf(buf, "%010ld", curtime());
+			(void) snprintf(buf, sizeof buf, "%010ld", curtime());
 			ndbm_map_store(map, "YP_LAST_MODIFIED", buf);
 
 			(void) gethostname(buf, sizeof buf);
@@ -1033,7 +1040,7 @@ db_map_open(map, mode, dbtype)
 	struct stat st;
 	char buf[MAXNAME + 1];
 
-	(void) strcpy(buf, map->map_file);
+	snprintf(buf, sizeof buf - 3, "%s", map->map_file);
 	i = strlen(buf);
 	if (i < 3 || strcmp(&buf[i - 3], ".db") != 0)
 		(void) strcat(buf, ".db");
@@ -1249,7 +1256,8 @@ db_map_store(map, lhs, rhs)
 					bufsiz = data.size + old.size + 2;
 					buf = xalloc(bufsiz);
 				}
-				sprintf(buf, "%s,%s", data.data, old.data);
+				snprintf(buf, bufsiz, "%s,%s",
+					data.data, old.data);
 				data.size = data.size + old.size + 1;
 				data.data = buf;
 				if (tTd(38, 9))
@@ -1508,7 +1516,7 @@ nis_getcanonname(name, hbsize, statp)
 	host_record[vsize] = '\0';
 	if (tTd(38, 44))
 		printf("got record `%s'\n", host_record);
-	if (!extract_canonname(nbuf, host_record, cbuf))
+	if (!extract_canonname(nbuf, host_record, cbuf, sizeof cbuf))
 	{
 		/* this should not happen, but.... */
 		*statp = EX_NOHOST;
@@ -1586,7 +1594,8 @@ nisplus_map_open(map, mode)
 
 	/* check to see if this map actually exists */
 	if (PARTIAL_NAME(map->map_file))
-		sprintf(qbuf, "%s.%s", map->map_file, map->map_domain);
+		snprintf(qbuf, sizeof qbuf, "%s.%s",
+			map->map_file, map->map_domain);
 	else
 		strcpy(qbuf, map->map_file);
 	
@@ -1724,11 +1733,12 @@ nisplus_map_lookup(map, name, av, statp)
 
 	/* construct the query */
 	if (PARTIAL_NAME(map->map_file))
-		sprintf(qbuf, "[%s=%s],%s.%s", map->map_keycolnm,
-			search_key, map->map_file, map->map_domain);
+		snprintf(qbuf, sizeof qbuf, "[%s=%s],%s.%s",
+			map->map_keycolnm, search_key, map->map_file,
+			map->map_domain);
 	else
-		sprintf(qbuf, "[%s=%s],%s", map->map_keycolnm,
-			search_key, map->map_file);
+		snprintf(qbuf, sizeof qbuf, "[%s=%s],%s",
+			map->map_keycolnm, search_key, map->map_file);
 
 	if (tTd(38, 20))
 		printf("qbuf=%s\n", qbuf);
@@ -1816,13 +1826,14 @@ nisplus_getcanonname(name, hbsize, statp)
 	if (p == NULL)
 	{
 		/* single token */
-		sprintf(qbuf, "[name=%s],hosts.org_dir", nbuf);
+		snprintf(qbuf, sizeof qbuf, "[name=%s],hosts.org_dir", nbuf);
 	}
 	else if (p[1] != '\0')
 	{
 		/* multi token -- take only first token in nbuf */
 		*p = '\0';
-		sprintf(qbuf, "[name=%s],hosts.org_dir.%s", nbuf, &p[1]);
+		snprintf(qbuf, sizeof qbuf, "[name=%s],hosts.org_dir.%s",
+			nbuf, &p[1]);
 	}
 	else
 	{
@@ -1882,7 +1893,7 @@ nisplus_getcanonname(name, hbsize, statp)
 			if (domain[0] == '\0')
 				strcpy(name, vp);
 			else
-				sprintf(name, "%s.%s", vp, domain);
+				snprintf(name, hbsize, "%s.%s", vp, domain);
 			*statp = EX_OK;
 		}
 		else
@@ -1917,7 +1928,7 @@ nisplus_default_domain()
 		return(default_domain);
 	
 	p = nis_local_directory();
-	strcpy(default_domain, p);
+	snprintf(default_domain, sizeof default_domain, "%s", p);
 	return default_domain;
 }
 
@@ -2450,8 +2461,7 @@ text_map_lookup(map, name, av, statp)
 	char delim;
 	int key_idx;
 	bool found_it;
-	extern char *get_column();
-
+	extern char *get_column __P((char *, int, char, char *, int));
 
 	found_it = FALSE;
 	if (tTd(38, 20))
@@ -2483,7 +2493,7 @@ text_map_lookup(map, name, av, statp)
 		p = strchr(linebuf, '\n');
 		if (p != NULL)
 			*p = '\0';
-		p = get_column(linebuf, key_idx, delim, buf);
+		p = get_column(linebuf, key_idx, delim, buf, sizeof buf);
 		if (p != NULL && strcasecmp(search_key, p) == 0)
 		{
 			found_it = TRUE;
@@ -2496,7 +2506,7 @@ text_map_lookup(map, name, av, statp)
 		*statp = EX_NOTFOUND;
 		return NULL;
 	}
-	vp = get_column(linebuf, map->map_valcolno, delim, buf);
+	vp = get_column(linebuf, map->map_valcolno, delim, buf, sizeof buf);
 	vsize = strlen(vp);
 	*statp = EX_OK;
 	if (bitset(MF_MATCHONLY, map->map_mflags))
@@ -2523,7 +2533,7 @@ text_getcanonname(name, hbsize, statp)
 	char cbuf[MAXNAME + 1];
 	char fbuf[MAXNAME + 1];
 	char nbuf[MAXNAME + 1];
-	extern char *get_column();
+	extern char *get_column __P((char *, int, char, char *, int));
 
 	if (tTd(38, 20))
 		printf("text_getcanonname(%s)\n", name);
@@ -2550,7 +2560,7 @@ text_getcanonname(name, hbsize, statp)
 		if (p != NULL)
 			*p = '\0';
 		if (linebuf[0] != '\0')
-			found = extract_canonname(nbuf, linebuf, cbuf);
+			found = extract_canonname(nbuf, linebuf, cbuf, sizeof cbuf);
 	}
 	fclose(f);
 	if (!found)
@@ -2883,12 +2893,12 @@ user_map_lookup(map, key, av, statp)
 			break;
 
 		  case 3:
-			sprintf(buf, "%d", pw->pw_uid);
+			snprintf(buf, sizeof buf, "%d", pw->pw_uid);
 			rwval = buf;
 			break;
 
 		  case 4:
-			sprintf(buf, "%d", pw->pw_gid);
+			snprintf(buf, sizeof buf, "%d", pw->pw_gid);
 			rwval = buf;
 			break;
 
@@ -2939,7 +2949,7 @@ prog_map_lookup(map, name, av, statp)
 	argv[i++] = map->map_file;
 	if (map->map_rebuild != NULL)
 	{
-		strcpy(buf, map->map_rebuild);
+		snprintf(buf, sizeof buf, "%s", map->map_rebuild);
 		for (p = strtok(buf, " \t"); p != NULL; p = strtok(NULL, " \t"))
 		{
 			if (i >= MAXPV - 1)
@@ -3138,7 +3148,8 @@ switch_map_open(map, mode)
 
 		if (maptype[mapno] == NULL)
 			continue;
-		(void) sprintf(nbuf, "%s.%s", map->map_mname, maptype[mapno]);
+		(void) snprintf(nbuf, sizeof nbuf, "%s.%s",
+			map->map_mname, maptype[mapno]);
 		s = stab(nbuf, ST_MAP, ST_FIND);
 		if (s == NULL)
 		{
diff --git a/usr.sbin/sendmail/src/mci.c b/usr.sbin/sendmail/src/mci.c
index ee0da2d..beff019 100644
--- a/usr.sbin/sendmail/src/mci.c
+++ b/usr.sbin/sendmail/src/mci.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)mci.c	8.22 (Berkeley) 11/18/95";
+static char sccsid[] = "@(#)mci.c	8.22.1.1 (Berkeley) 9/16/96";
 #endif /* not lint */
 
 #include "sendmail.h"
@@ -372,24 +372,27 @@ mci_dump(mci, logit)
 
 	sep = logit ? " " : "\n\t";
 	p = buf;
-	sprintf(p, "MCI@%x: ", mci);
+	snprintf(p, SPACELEFT(buf, p), "MCI@%x: ", mci);
 	p += strlen(p);
 	if (mci == NULL)
 	{
-		sprintf(p, "NULL");
+		snprintf(p, SPACELEFT(buf, p), "NULL");
 		goto printit;
 	}
-	sprintf(p, "flags=%x, errno=%d, herrno=%d, exitstat=%d, state=%d, pid=%d,%s",
+	snprintf(p, SPACELEFT(buf, p),
+		"flags=%x, errno=%d, herrno=%d, exitstat=%d, state=%d, pid=%d,%s",
 		mci->mci_flags, mci->mci_errno, mci->mci_herrno,
 		mci->mci_exitstat, mci->mci_state, mci->mci_pid, sep);
 	p += strlen(p);
-	sprintf(p, "maxsize=%ld, phase=%s, mailer=%s,%s",
+	snprintf(p, SPACELEFT(buf, p),
+		"maxsize=%ld, phase=%s, mailer=%s,%s",
 		mci->mci_maxsize,
 		mci->mci_phase == NULL ? "NULL" : mci->mci_phase,
 		mci->mci_mailer == NULL ? "NULL" : mci->mci_mailer->m_name,
 		sep);
 	p += strlen(p);
-	sprintf(p, "host=%s, lastuse=%s",
+	snprintf(p, SPACELEFT(buf, p),
+		"host=%s, lastuse=%s",
 		mci->mci_host == NULL ? "NULL" : mci->mci_host,
 		ctime(&mci->mci_lastuse));
 printit:
diff --git a/usr.sbin/sendmail/src/mime.c b/usr.sbin/sendmail/src/mime.c
index acbc04c..1c71a84 100644
--- a/usr.sbin/sendmail/src/mime.c
+++ b/usr.sbin/sendmail/src/mime.c
@@ -36,7 +36,7 @@
 # include <string.h>
 
 #ifndef lint
-static char sccsid[] = "@(#)mime.c	8.30 (Berkeley) 10/31/95";
+static char sccsid[] = "@(#)mime.c	8.30.1.1 (Berkeley) 9/16/96";
 #endif /* not lint */
 
 /*
@@ -222,7 +222,7 @@ mime8to7(mci, header, e, boundaries, flags)
 	**	just copy it through.
 	*/
 
-	sprintf(buf, "%.100s/%.100s", type, subtype);
+	snprintf(buf, sizeof buf, "%.100s/%.100s", type, subtype);
 	if (wordinclass(buf, 'n') || (cte != NULL && !wordinclass(cte, 'e')))
 		flags |= M87F_NO8BIT;
 
@@ -294,7 +294,7 @@ mime8to7(mci, header, e, boundaries, flags)
 		{
 			auto HDR *hdr = NULL;
 
-			sprintf(buf, "--%s", bbuf);
+			snprintf(buf, sizeof buf, "--%s", bbuf);
 			putline(buf, mci);
 			if (tTd(43, 35))
 				printf("  ...%s\n", buf);
@@ -306,7 +306,7 @@ mime8to7(mci, header, e, boundaries, flags)
 				putline("+++after putheader", mci);
 			bt = mime8to7(mci, hdr, e, boundaries, flags);
 		}
-		sprintf(buf, "--%s--", bbuf);
+		snprintf(buf, sizeof buf, "--%s--", bbuf);
 		putline(buf, mci);
 		if (tTd(43, 35))
 			printf("  ...%s\n", buf);
@@ -435,7 +435,8 @@ mime8to7(mci, header, e, boundaries, flags)
 		/* no encoding necessary */
 		if (cte != NULL)
 		{
-			sprintf(buf, "Content-Transfer-Encoding: %.200s", cte);
+			snprintf(buf, sizeof buf,
+				"Content-Transfer-Encoding: %.200s", cte);
 			putline(buf, mci);
 			if (tTd(43, 36))
 				printf("  ...%s\n", buf);
diff --git a/usr.sbin/sendmail/src/queue.c b/usr.sbin/sendmail/src/queue.c
index bd89a31..eb5176e 100644
--- a/usr.sbin/sendmail/src/queue.c
+++ b/usr.sbin/sendmail/src/queue.c
@@ -36,9 +36,9 @@
 
 #ifndef lint
 #ifdef QUEUE
-static char sccsid[] = "@(#)queue.c	8.98.1.1 (Berkeley) 2/18/96 (with queueing)";
+static char sccsid[] = "@(#)queue.c	8.98.1.3 (Berkeley) 9/16/96 (with queueing)";
 #else
-static char sccsid[] = "@(#)queue.c	8.98.1.1 (Berkeley) 2/18/96 (without queueing)";
+static char sccsid[] = "@(#)queue.c	8.98.1.3 (Berkeley) 9/16/96 (without queueing)";
 #endif
 #endif /* not lint */
 
@@ -66,7 +66,7 @@ typedef struct work	WORK;
 
 WORK	*WorkQ;			/* queue of things to be done */
 
-#define QF_VERSION	1	/* version number of this queue format */
+#define QF_VERSION	2	/* version number of this queue format */
 
 #if !defined(NGROUPS_MAX) && defined(NGROUPS)
 # define NGROUPS_MAX	NGROUPS	/* POSIX naming convention */
@@ -458,9 +458,11 @@ printctladdr(a, tfp)
 	FILE *tfp;
 {
 	char *uname;
+	char *paddr;
 	register struct passwd *pw;
 	register ADDRESS *q;
 	uid_t uid;
+	gid_t gid;
 	static ADDRESS *lastctladdr;
 	static uid_t lastuid;
 
@@ -477,9 +479,17 @@ printctladdr(a, tfp)
 	/* find the active uid */
 	q = getctladdr(a);
 	if (q == NULL)
+	{
+		uname = NULL;
 		uid = 0;
+		gid = 0;
+	}
 	else
+	{
+		uname = q->q_ruser != NULL ? q->q_ruser : q->q_user;
 		uid = q->q_uid;
+		gid = q->q_gid;
+	}
 	a = a->q_alias;
 
 	/* check to see if this is the same as last time */
@@ -489,12 +499,12 @@ printctladdr(a, tfp)
 	lastuid = uid;
 	lastctladdr = a;
 
-	if (uid == 0 || (pw = sm_getpwuid(uid)) == NULL)
-		uname = "";
+	paddr = denlstring(a->q_paddr, TRUE, FALSE);
+	if (uid == 0 || uname == NULL || uname[0] == '\0')
+		fprintf(tfp, "C:%s\n", paddr);
 	else
-		uname = pw->pw_name;
-
-	fprintf(tfp, "C%s:%s\n", uname, denlstring(a->q_paddr, TRUE, FALSE));
+		fprintf(tfp, "C%s:%ld:%ld:%s\n",
+			uname, (long) uid, (long) gid, paddr);
 }
 /*
 **  RUNQUEUE -- run the jobs in the queue.
@@ -1299,7 +1309,7 @@ readqf(e)
 	bool nomore = FALSE;
 	char qf[20];
 	char buf[MAXLINE];
-	extern ADDRESS *setctluser();
+	extern ADDRESS *setctluser __P((char *, int));
 	extern void loseqfile();
 
 	/*
@@ -1421,7 +1431,7 @@ readqf(e)
 			break;
 
 		  case 'C':		/* specify controlling user */
-			ctladdr = setctluser(&bp[1]);
+			ctladdr = setctluser(&bp[1], qfver);
 			break;
 
 		  case 'Q':		/* original recipient */
@@ -1876,7 +1886,7 @@ queuename(e, type)
 			c1 = 'A';
 			c2 = 'A' - 1;
 		}
-		(void) sprintf(qf, "qf%cAA%05d", c0, pid);
+		(void) snprintf(qf, sizeof qf, "qf%cAA%05d", c0, pid);
 
 		while (c1 < '~' || c2 < 'Z')
 		{
@@ -1933,7 +1943,7 @@ queuename(e, type)
 
 	if (type == '\0')
 		return (NULL);
-	(void) sprintf(buf, "%cf%s", type, e->e_id);
+	(void) snprintf(buf, sizeof buf, "%cf%s", type, e->e_id);
 	if (tTd(7, 2))
 		printf("queuename: %s\n", buf);
 	return (buf);
@@ -1984,6 +1994,7 @@ unlockqueue(e)
 **
 **	Parameters:
 **		user -- the user name of the controlling user.
+**		qfver -- the version stamp of this qf file.
 **
 **	Returns:
 **		An address descriptor for the controlling user.
@@ -1993,8 +2004,9 @@ unlockqueue(e)
 */
 
 ADDRESS *
-setctluser(user)
+setctluser(user, qfver)
 	char *user;
+	int qfver;
 {
 	register ADDRESS *a;
 	struct passwd *pw;
@@ -2014,26 +2026,40 @@ setctluser(user)
 	a = (ADDRESS *) xalloc(sizeof *a);
 	bzero((char *) a, sizeof *a);
 
-	p = strchr(user, ':');
-	if (p != NULL)
-		*p++ = '\0';
-	if (*user != '\0' && (pw = sm_getpwnam(user)) != NULL)
+	if (*user == '\0')
 	{
-		if (strcmp(pw->pw_dir, "/") == 0)
-			a->q_home = "";
-		else
-			a->q_home = newstr(pw->pw_dir);
-		a->q_uid = pw->pw_uid;
-		a->q_gid = pw->pw_gid;
-		a->q_flags |= QGOODUID;
+		p = NULL;
+		a->q_user = newstr(DefUser);
 	}
-
-	if (*user != '\0')
-		a->q_user = newstr(user);
-	else if (p != NULL)
+	else if (*user == ':')
+	{
+		p = &user[1];
 		a->q_user = newstr(p);
+	}
 	else
-		a->q_user = newstr(DefUser);
+	{
+		p = strtok(user, ":");
+		a->q_user = newstr(user);
+		if (qfver >= 2)
+		{
+			if ((p = strtok(NULL, ":")) != NULL)
+				a->q_uid = atoi(p);
+			if ((p = strtok(NULL, ":")) != NULL)
+				a->q_gid = atoi(p);
+			if ((p = strtok(NULL, ":")) != NULL)
+				a->q_flags |= QGOODUID;
+		}
+		else if ((pw = sm_getpwnam(user)) != NULL)
+		{
+			if (strcmp(pw->pw_dir, "/") == 0)
+				a->q_home = "";
+			else
+				a->q_home = newstr(pw->pw_dir);
+			a->q_uid = pw->pw_uid;
+			a->q_gid = pw->pw_gid;
+			a->q_flags |= QGOODUID;
+		}
+	}
 
 	a->q_flags |= QPRIMARY;		/* flag as a "ctladdr"  */
 	a->q_mailer = LocalMailer;
diff --git a/usr.sbin/sendmail/src/version.c b/usr.sbin/sendmail/src/version.c
index 3c6f7d1..6197db9 100644
--- a/usr.sbin/sendmail/src/version.c
+++ b/usr.sbin/sendmail/src/version.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)version.c	8.7.5.1 (Berkeley) 3/4/96";
+static char sccsid[] = "@(#)version.c	8.7.6.4 (Berkeley) 9/17/96";
 #endif /* not lint */
 
-char	Version[] = "8.7.5";
+char	Version[] = "8.7.6";