Use setuid/seteuid around dangerous operations. Also a few buffer

overflow patches that were "near" to where these operations are taking
place.  The buffer overflows are from OpenBSD.  The setuid/seteuid patches
are from NetBSD by way of OpenBSD (they changed them a little), at least from
my read of the tree.

This is the first of a series of OpenBSD lpr/et al merges.  It (and them)
should be merged back into 2.2 and/or 2.1 (if requested) branches when they
have been shaken out in -current.
Obtained from: OpenBSD

1 files changed, 29 insertions, 5 deletions

diff --git a/usr.sbin/lpr/common_source/displayq.c b/usr.sbin/lpr/common_source/displayq.c
index a5b8b26..eafaf0c 100644
--- a/usr.sbin/lpr/common_source/displayq.c
+++ b/usr.sbin/lpr/common_source/displayq.c
@@ -61,6 +61,8 @@ static char sccsid[] = "@(#)displayq.c	8.4 (Berkeley) 4/28/95";
 /*
  * Stuff for handling job specifications
  */
+extern uid_t	uid, euid;
+
 static int	col;		/* column on screen */
 static char	current[40];	/* current file being printed */
 static char	file[132];	/* print file name */
@@ -83,7 +85,7 @@ displayq(format)
 	int format;
 {
 	register struct queue *q;
-	register int i, nitems, fd;
+	register int i, nitems, fd, ret;
 	register char	*cp;
 	struct queue **queue;
 	struct stat statb;
@@ -110,23 +112,30 @@ displayq(format)
 	if (cgetstr(bp, "st", &ST) < 0)
 		ST = DEFSTAT;
 	cgetstr(bp, "rm", &RM);
-	if (cp = checkremote())
+	if ((cp = checkremote()))
 		printf("Warning: %s\n", cp);
 
 	/*
 	 * Print out local queue
 	 * Find all the control files in the spooling directory
 	 */
+	seteuid(euid);
 	if (chdir(SD) < 0)
 		fatal("cannot chdir to spooling directory");
+	seteuid(uid);
 	if ((nitems = getq(&queue)) < 0)
 		fatal("cannot examine spooling area\n");
-	if (stat(LO, &statb) >= 0) {
+	seteuid(euid);
+	ret = stat(LO, &statb);
+	seteuid(uid);
+	if (ret >= 0) {
 		if (statb.st_mode & 0100) {
 			if (remote)
 				printf("%s: ", host);
 			printf("Warning: %s is down: ", printer);
+			seteuid(euid);
 			fd = open(ST, O_RDONLY);
+			seteuid(uid);
 			if (fd >= 0) {
 				(void) flock(fd, LOCK_SH);
 				while ((i = read(fd, line, sizeof(line))) > 0)
@@ -143,7 +152,9 @@ displayq(format)
 	}
 
 	if (nitems) {
+		seteuid(euid);
 		fp = fopen(LO, "r");
+		seteuid(uid);
 		if (fp == NULL)
 			warn();
 		else {
@@ -153,9 +164,16 @@ displayq(format)
 				*cp++ = i;
 			*cp = '\0';
 			i = atoi(current);
-			if (i <= 0 || kill(i, 0) < 0)
+			if (i <= 0) {
+				ret = -1;
+			} else {
+				seteuid(euid);
+				ret = kill(i, 0);
+				seteuid(uid);
+			}
+			if (ret < 0) {
 				warn();
-			else {
+			} else {
 				/* read current file name */
 				cp = current;
 				while ((i = getc(fp)) != EOF && i != '\n')
@@ -166,7 +184,9 @@ displayq(format)
 				 */
 				if (remote)
 					printf("%s: ", host);
+				seteuid(euid);
 				fd = open(ST, O_RDONLY);
+				seteuid(uid);
 				if (fd >= 0) {
 					(void) flock(fd, LOCK_SH);
 					while ((i = read(fd, line, sizeof(line))) > 0)
@@ -269,8 +289,10 @@ inform(cf)
 	 * There's a chance the control file has gone away
 	 * in the meantime; if this is the case just keep going
 	 */
+	seteuid(euid);
 	if ((cfp = fopen(cf, "r")) == NULL)
 		return;
+	seteuid(uid);
 
 	if (rank < 0)
 		rank = 0;
@@ -401,8 +423,10 @@ dump(nfile, file, copies)
 		printf("%s", nfile);
 		col += n+fill;
 	}
+	seteuid(euid);
 	if (*file && !stat(file, &lbuf))
 		totsize += copies * lbuf.st_size;
+	seteuid(uid);
 }
 
 /*