PR: bin/8250

protect against buffer overruns in mail temporary files.

7 files changed, 24 insertions, 14 deletions

diff --git a/usr.bin/mail/collect.c b/usr.bin/mail/collect.c
index 97f0794..7e959ef 100644
--- a/usr.bin/mail/collect.c
+++ b/usr.bin/mail/collect.c
@@ -77,7 +77,7 @@ collect(hp, printheaders)
 	int lc, cc, escape, eofcount;
 	register int c, t;
 	char linebuf[LINESIZE], *cp;
-	extern char tempMail[];
+	extern char *tempMail;
 	char getsub;
 	int omask;
 	void collint(), collhup(), collstop();
@@ -472,7 +472,7 @@ mespipe(fp, cmd)
 {
 	FILE *nf;
 	sig_t sigint = signal(SIGINT, SIG_IGN);
-	extern char tempEdit[];
+	extern char *tempEdit;
 	char *shell;
 
 	if ((nf = Fopen(tempEdit, "w+")) == NULL) {
@@ -521,7 +521,7 @@ forward(ms, fp, f)
 	int f;
 {
 	register int *msgvec;
-	extern char tempMail[];
+	extern char *tempMail;
 	struct ignoretab *ig;
 	char *tabst;
 
diff --git a/usr.bin/mail/edit.c b/usr.bin/mail/edit.c
index 97d3bd4..2042719 100644
--- a/usr.bin/mail/edit.c
+++ b/usr.bin/mail/edit.c
@@ -148,7 +148,7 @@ run_editor(fp, size, type, readonly)
 	time_t modtime;
 	char *edit;
 	struct stat statb;
-	extern char tempEdit[];
+	extern char *tempEdit;
 
 	if ((t = creat(tempEdit, readonly ? 0400 : 0600)) < 0) {
 		perror(tempEdit);
diff --git a/usr.bin/mail/lex.c b/usr.bin/mail/lex.c
index c6fee20..cc4972d 100644
--- a/usr.bin/mail/lex.c
+++ b/usr.bin/mail/lex.c
@@ -64,12 +64,13 @@ setfile(name)
 	char isedit = *name != '%';
 	char *who = name[1] ? name + 1 : myname;
 	static int shudclob;
-	extern char tempMesg[];
+	extern char *tempMesg;
 	extern int errno;
 
 	if ((name = expand(name)) == NOSTR)
 		return -1;
 
+fprintf(stderr,">%s\n",name);
 	if ((ibuf = Fopen(name, "r")) == NULL) {
 		if (!isedit && errno == ENOENT)
 			goto nomail;
diff --git a/usr.bin/mail/names.c b/usr.bin/mail/names.c
index 2050942..ef8c1dd 100644
--- a/usr.bin/mail/names.c
+++ b/usr.bin/mail/names.c
@@ -223,7 +223,7 @@ outof(names, fo, hp)
 	char *date, *fname, *ctime();
 	FILE *fout, *fin;
 	int ispipe;
-	extern char tempEdit[];
+	extern char *tempEdit;
 
 	top = names;
 	np = names;
diff --git a/usr.bin/mail/quit.c b/usr.bin/mail/quit.c
index 05e708f..d6d8f68 100644
--- a/usr.bin/mail/quit.c
+++ b/usr.bin/mail/quit.c
@@ -72,7 +72,7 @@ quit()
 	FILE *ibuf, *obuf, *fbuf, *rbuf, *readstat, *abuf;
 	register struct message *mp;
 	register int c;
-	extern char tempQuit[], tempResid[];
+	extern char *tempQuit, *tempResid;
 	struct stat minfo;
 	char *mbox;
 
diff --git a/usr.bin/mail/send.c b/usr.bin/mail/send.c
index b791e29..5d7e3e1 100644
--- a/usr.bin/mail/send.c
+++ b/usr.bin/mail/send.c
@@ -428,7 +428,7 @@ infix(hp, fi)
 	struct header *hp;
 	FILE *fi;
 {
-	extern char tempMail[];
+	extern char *tempMail;
 	register FILE *nfo, *nfi;
 	register int c;
 
diff --git a/usr.bin/mail/temp.c b/usr.bin/mail/temp.c
index 37f6026..ef867cc 100644
--- a/usr.bin/mail/temp.c
+++ b/usr.bin/mail/temp.c
@@ -36,7 +36,7 @@
 static char sccsid[] = "@(#)temp.c	8.1 (Berkeley) 6/6/93";
 #endif
 static const char rcsid[] =
-	"$Id$";
+	"$Id: temp.c,v 1.3 1997/07/24 06:56:33 charnier Exp $";
 #endif /* not lint */
 
 #include "rcv.h"
@@ -49,11 +49,11 @@ static const char rcsid[] =
  * Give names to all the temporary files that we will need.
  */
 
-char	tempMail[24];
-char	tempQuit[24];
-char	tempEdit[24];
-char	tempResid[24];
-char	tempMesg[24];
+char	*tempMail;
+char	*tempQuit;
+char	*tempEdit;
+char	*tempResid;
+char	*tempMesg;
 char	*tmpdir;
 
 void
@@ -74,14 +74,23 @@ tinit()
 		tmpdir = cp;
 	}
 
+	tempMail=(char *)malloc(len+sizeof("RsXXXXXX"));
 	strcpy(tempMail, tmpdir);
 	mktemp(strcat(tempMail, "RsXXXXXX"));
+
+	tempResid=(char *)malloc(len+sizeof("RqXXXXXX"));
 	strcpy(tempResid, tmpdir);
 	mktemp(strcat(tempResid, "RqXXXXXX"));
+
+	tempQuit=(char *)malloc(len+sizeof("RmXXXXXX"));
 	strcpy(tempQuit, tmpdir);
 	mktemp(strcat(tempQuit, "RmXXXXXX"));
+
+	tempEdit=(char *)malloc(len+sizeof("ReXXXXXX"));
 	strcpy(tempEdit, tmpdir);
 	mktemp(strcat(tempEdit, "ReXXXXXX"));
+
+	tempMesg=(char *)malloc(len+sizeof("RxXXXXXX"));
 	strcpy(tempMesg, tmpdir);
 	mktemp(strcat(tempMesg, "RxXXXXXX"));