Fix many buffer overruns in the code. Specifically, disallow ExpandString

to be used to expand things beyond the size of the buffer passed in.  Also
do a general cleanup of sprintf -> snprintf as well as strcpy and strncat
safety.  Also expand some buffers to allow for the largest possible data
that might be used.

This is a 2.2 candidate.  However, it needs to be vetted on -current
since little testing has been done on this due to my lack of PPP on
this machine.

Reviewed by:	Jordan Hubbard, Peter Wemm, Guido van Rooij

1 files changed, 8 insertions, 6 deletions

diff --git a/usr.sbin/ppp/ipcp.c b/usr.sbin/ppp/ipcp.c
index 3be3686..2b72002 100644
--- a/usr.sbin/ppp/ipcp.c
+++ b/usr.sbin/ppp/ipcp.c
@@ -17,7 +17,7 @@
  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * $Id: ipcp.c,v 1.9 1996/10/06 13:32:28 jkh Exp $
+ * $Id: ipcp.c,v 1.10 1996/12/12 14:39:44 jkh Exp $
  *
  *	TODO:
  *		o More RFC1772 backwoard compatibility
@@ -269,7 +269,8 @@ struct fsm *fp;
 #endif
   Prompt(1);
   LogPrintf(LOG_LCP_BIT, "%s: LayerUp.\n", fp->name);
-  sprintf(tbuff, "myaddr = %s ", inet_ntoa(IpcpInfo.want_ipaddr));
+  snprintf(tbuff, sizeof(tbuff), "myaddr = %s ", 
+    inet_ntoa(IpcpInfo.want_ipaddr));
   LogPrintf(LOG_LCP_BIT|LOG_LINK_BIT, " %s hisaddr = %s\n", tbuff, inet_ntoa(IpcpInfo.his_ipaddr));
   OsSetIpaddress(IpcpInfo.want_ipaddr, IpcpInfo.his_ipaddr, ifnetmask);
   OsLinkup();
@@ -319,6 +320,7 @@ int mode;
   struct compreq *pcomp;
   struct in_addr ipaddr, dstipaddr, dnsstuff, ms_info_req;
   char tbuff[100];
+  char tbuff2[100];
 
   ackp = AckBuff;
   nakp = NakBuff;
@@ -330,9 +332,9 @@ int mode;
     type = *cp;
     length = cp[1];
     if (type <= TY_IPADDR)
-      sprintf(tbuff, " %s[%d] ", cftypes[type], length);
+      snprintf(tbuff, sizeof(tbuff), " %s[%d] ", cftypes[type], length);
     else
-      sprintf(tbuff, " ");
+      snprintf(tbuff, sizeof(tbuff), " ");
 
     switch (type) {
     case TY_IPADDR:		/* RFC1332 */
@@ -362,8 +364,8 @@ int mode;
           /*
            * Use address suggested by peer.
            */
-	  sprintf(tbuff+50, "%s changing address: %s ", tbuff, inet_ntoa(IpcpInfo.want_ipaddr));
-	  LogPrintf(LOG_LCP_BIT, "%s --> %s\n", tbuff+50, inet_ntoa(ipaddr));
+	  snprintf(tbuff2, sizeof(tbuff2), "%s changing address: %s ", tbuff, inet_ntoa(IpcpInfo.want_ipaddr));
+	  LogPrintf(LOG_LCP_BIT, "%s --> %s\n", tbuff2, inet_ntoa(ipaddr));
 	  IpcpInfo.want_ipaddr = ipaddr;
 	}
 	break;