Back out last commit, since it accidentally broke pts.

The security fix will be re-committed soon, hopefully without breaking
anything.

1 files changed, 48 insertions, 37 deletions

diff --git a/lib/libc/stdlib/grantpt.c b/lib/libc/stdlib/grantpt.c
index ae49127..0ce89fc 100644
--- a/lib/libc/stdlib/grantpt.c
+++ b/lib/libc/stdlib/grantpt.c
@@ -75,6 +75,23 @@ __FBSDID("$FreeBSD$");
  */
 #define _PATH_PTCHOWN	"/usr/libexec/pt_chown"
 
+/*
+ * ISPTM(x) returns 0 for struct stat x if x is not a pty master.
+ * The bounds checking may be unnecessary but it does eliminate doubt.
+ */
+#define ISPTM(x)	(S_ISCHR((x).st_mode) && 			\
+			 minor((x).st_rdev) >= 0 &&			\
+			 minor((x).st_rdev) < PTY_MAX)
+
+
+static int
+is_pts(int fd)
+{
+	int nb;
+
+	return (_ioctl(fd, TIOCGPTN, &nb) == 0);
+}
+
 int
 __use_pts(void)
 {
@@ -234,43 +251,33 @@ char *
 ptsname(int fildes)
 {
 	static char pty_slave[] = _PATH_DEV PTYS_PREFIX "XY";
-#if 0
 	static char ptmx_slave[] = _PATH_DEV PTMXS_PREFIX "4294967295";
-#endif
-	const char *master;
+	char *retval;
 	struct stat sbuf;
-#if 0
-	int ptn;
-
-	/* Handle pts(4) masters first. */
-	if (_ioctl(fildes, TIOCGPTN, &ptn) == 0) {
-		(void)snprintf(ptmx_slave, sizeof(ptmx_slave),
-		    _PATH_DEV PTMXS_PREFIX "%d", ptn);
-		return (ptmx_slave);
+
+	retval = NULL;
+
+	if (_fstat(fildes, &sbuf) == 0) {
+		if (!ISPTM(sbuf))
+			errno = EINVAL;
+		else {
+			if (!is_pts(fildes)) {
+				(void)snprintf(pty_slave, sizeof(pty_slave),
+					       _PATH_DEV PTYS_PREFIX "%s",
+					       devname(sbuf.st_rdev, S_IFCHR) +
+					       strlen(PTYM_PREFIX));
+				retval = pty_slave;
+			} else {
+				(void)snprintf(ptmx_slave, sizeof(ptmx_slave),
+					       _PATH_DEV PTMXS_PREFIX "%s",
+					       devname(sbuf.st_rdev, S_IFCHR) +
+					       strlen(PTMXM_PREFIX));
+				retval = ptmx_slave;
+			}
+		}
 	}
-#endif
-
-	/* All master pty's must be char devices. */
-	if (_fstat(fildes, &sbuf) == -1)
-		goto invalid;
-	if (!S_ISCHR(sbuf.st_mode))
-		goto invalid;
-
-	/* Check to see if this device is a pty(4) master. */
-	master = devname(sbuf.st_rdev, S_IFCHR);
-	if (strlen(master) != strlen(PTYM_PREFIX "XY"))
-		goto invalid;
-	if (strncmp(master, PTYM_PREFIX, strlen(PTYM_PREFIX)) != 0)
-		goto invalid;
-
-	/* It is, so generate the corresponding pty(4) slave name. */
-	(void)snprintf(pty_slave, sizeof(pty_slave), _PATH_DEV PTYS_PREFIX "%s",
-	    master + strlen(PTYM_PREFIX));
-	return (pty_slave);
-
-invalid:
-	errno = EINVAL;
-	return (NULL);
+
+	return (retval);
 }
 
 /*
@@ -279,14 +286,18 @@ invalid:
 int
 unlockpt(int fildes)
 {
+	int retval;
+	struct stat sbuf;
 
 	/*
 	 * Unlocking a master/slave pseudo-terminal pair has no meaning in a
 	 * non-streams PTY environment.  However, we do ensure fildes is a
 	 * valid master pseudo-terminal device.
 	 */
-	if (ptsname(fildes) == NULL)
-		return (-1);
+	if ((retval = _fstat(fildes, &sbuf)) == 0 && !ISPTM(sbuf)) {
+		errno = EINVAL;
+		retval = -1;
+	}
 
-	return (0);
+	return (retval);
 }