Upgrade NTP to 4.2.8p4.

Security:	FreeBSD-SA-15:25.ntp
Security:	CVE-2015-7871
Security:	CVE-2015-7855
Security:	CVE-2015-7854
Security:	CVE-2015-7853
Security:	CVE-2015-7852
Security:	CVE-2015-7851
Security:	CVE-2015-7850
Security:	CVE-2015-7849
Security:	CVE-2015-7848
Security:	CVE-2015-7701
Security:	CVE-2015-7703
Security:	CVE-2015-7704, CVE-2015-7705
Security:	CVE-2015-7691, CVE-2015-7692, CVE-2015-7702
Approved by:	so

1 files changed, 19 insertions, 27 deletions

diff --git a/contrib/ntp/ntpd/refclock_tpro.c b/contrib/ntp/ntpd/refclock_tpro.c
index 3c42568..ac511bb 100644
--- a/contrib/ntp/ntpd/refclock_tpro.c
+++ b/contrib/ntp/ntpd/refclock_tpro.c
@@ -42,9 +42,9 @@ struct tprounit {
 /*
  * Function prototypes
  */
-static	int	tpro_start	P((int, struct peer *));
-static	void	tpro_shutdown	P((int, struct peer *));
-static	void	tpro_poll	P((int unit, struct peer *));
+static	int	tpro_start	(int, struct peer *);
+static	void	tpro_shutdown	(int, struct peer *);
+static	void	tpro_poll	(int unit, struct peer *);
 
 /*
  * Transfer vector
@@ -77,7 +77,7 @@ tpro_start(
 	/*
 	 * Open TPRO device
 	 */
-	(void)sprintf(device, DEVICE, unit);
+	snprintf(device, sizeof(device), DEVICE, unit);
 	fd = open(device, O_RDONLY | O_NDELAY, 0777);
 	if (fd == -1) {
 		msyslog(LOG_ERR, "tpro_start: open of %s: %m", device);
@@ -87,23 +87,18 @@ tpro_start(
 	/*
 	 * Allocate and initialize unit structure
 	 */
-	if (!(up = (struct tprounit *) emalloc(sizeof(struct tprounit)))) {
-		(void) close(fd);
-		return (0);
-	}
-	memset((char *)up, 0, sizeof(struct tprounit));
+	up = emalloc_zero(sizeof(*up));
 	pp = peer->procptr;
 	pp->io.clock_recv = noentry;
-	pp->io.srcclock = (caddr_t)peer;
+	pp->io.srcclock = peer;
 	pp->io.datalen = 0;
 	pp->io.fd = fd;
-	pp->unitptr = (caddr_t)up;
+	pp->unitptr = up;
 
 	/*
 	 * Initialize miscellaneous peer variables
 	 */
 	peer->precision = PRECISION;
-	peer->burst = NSTAGE;
 	pp->clockdesc = DESCRIPTION;
 	memcpy((char *)&pp->refid, REFID, 4);
 	return (1);
@@ -123,9 +118,10 @@ tpro_shutdown(
 	struct refclockproc *pp;
 
 	pp = peer->procptr;
-	up = (struct tprounit *)pp->unitptr;
+	up = pp->unitptr;
 	io_closeclock(&pp->io);
-	free(up);
+	if (NULL != up)
+		free(up);
 }
 
 
@@ -147,7 +143,7 @@ tpro_poll(
 	 * board and tacks on a local timestamp.
 	 */
 	pp = peer->procptr;
-	up = (struct tprounit *)pp->unitptr;
+	up = pp->unitptr;
 
 	tp = &up->tprodata;
 	if (read(pp->io.fd, (char *)tp, sizeof(struct tproval)) < 0) {
@@ -163,20 +159,20 @@ tpro_poll(
 	 * proper format, we declare bad format and exit. Note: we
 	 * can't use the sec/usec conversion produced by the driver,
 	 * since the year may be suspect. All format error checking is
-	 * done by the sprintf() and sscanf() routines.
+	 * done by the snprintf() and sscanf() routines.
 	 *
 	 * Note that the refclockproc usec member has now become nsec.
 	 * We could either multiply the read-in usec value by 1000 or
 	 * we could pad the written string appropriately and read the
 	 * resulting value in already scaled.
 	 */
-	sprintf(pp->a_lastcode,
-	    "%1x%1x%1x %1x%1x:%1x%1x:%1x%1x.%1x%1x%1x%1x%1x%1x %1x",
-	    tp->day100, tp->day10, tp->day1, tp->hour10, tp->hour1,
-	    tp->min10, tp->min1, tp->sec10, tp->sec1, tp->ms100,
-	    tp->ms10, tp->ms1, tp->usec100, tp->usec10, tp->usec1,
-	    tp->status);
-	    pp->lencode = strlen(pp->a_lastcode);
+	snprintf(pp->a_lastcode, sizeof(pp->a_lastcode),
+		 "%1x%1x%1x %1x%1x:%1x%1x:%1x%1x.%1x%1x%1x%1x%1x%1x %1x",
+		 tp->day100, tp->day10, tp->day1, tp->hour10, tp->hour1,
+		 tp->min10, tp->min1, tp->sec10, tp->sec1, tp->ms100,
+		 tp->ms10, tp->ms1, tp->usec100, tp->usec10, tp->usec1,
+		 tp->status);
+	pp->lencode = strlen(pp->a_lastcode);
 #ifdef DEBUG
 	if (debug)
 		printf("tpro: time %s timecode %d %s\n",
@@ -198,17 +194,13 @@ tpro_poll(
 		refclock_report(peer, CEVNT_BADTIME);
 		return;
 	}
-	if (peer->burst > 0)
-		return;
 	if (pp->coderecv == pp->codeproc) {
 		refclock_report(peer, CEVNT_TIMEOUT);
 		return;
 	}
-	refclock_receive(peer);
 	pp->lastref = pp->lastrec;
 	record_clock_stats(&peer->srcadr, pp->a_lastcode);
 	refclock_receive(peer);
-	peer->burst = NSTAGE;
 }
 
 #else