Change lpd to perform sanity and safety checks on control files as it

receives them from other hosts.  This is meant to protect from both
nefarious users (which maybe broke into some remote host that we accept
print jobs from), and broken implementations of lpr on other platforms.
This is done by changing recvjob.c to call the new ctl_renametf()
routine in the new common_source/ctlinfo.[ch] files.  This will not
affect jobs coming via lpr on the local machine.

Reviewed by:	freebsd-print@bostonradio.org & freebsd-audit
MFC after:	16 days

1 files changed, 7 insertions, 4 deletions

diff --git a/usr.sbin/lpr/lpd/recvjob.c b/usr.sbin/lpr/lpd/recvjob.c
index c610271..4d291c2 100644
--- a/usr.sbin/lpr/lpd/recvjob.c
+++ b/usr.sbin/lpr/lpd/recvjob.c
@@ -65,6 +65,7 @@ static const char rcsid[] =
 #include <string.h>
 #include "lp.h"
 #include "lp.local.h"
+#include "ctlinfo.h"
 #include "extern.h"
 #include "pathnames.h"
 
@@ -145,6 +146,7 @@ readjob(struct printer *pp)
 	register int size;
 	register char *cp;
 	int cfcnt, dfcnt;
+	char *errmsg;
 	char givenid[32], givenhost[MAXHOSTNAMELEN];
 
 	ack();
@@ -206,11 +208,12 @@ readjob(struct printer *pp)
 				rcleanup(0);
 				continue;
 			}
-			if (link(tfname, cp) < 0)
-				frecverr("%s: link(%s): %s", pp->printer,
-				    tfname, strerror(errno));
-			(void) unlink(tfname);
+			errmsg = ctl_renametf(pp->printer, tfname);
 			tfname[0] = '\0';
+			if (errmsg != NULL) {
+				frecverr("%s: %s", pp->printer, errmsg);
+				/*NOTREACHED*/
+			}
 			cfcnt++;
 			continue;