I remove pending signals completely, they are not useless, they are

dangerous! Signal handlers themself must be fixed to not call malloc,
but no pended handlers, it will be correct fix. In finite case each signal
handler can set some variable which will be analized later, but calling
handler functions manually is too dangerous (f.e. signals not blocked while
the handler or handlers switch executed in this case). Of course this
code can be fixed instead of removing, but it not worth fixing in any case.

Should go into 2.2

In addition sig.c code shows following dangerous fragments (there can be more,
but I stop after two):

This fragment

    if (fn == SIG_DFL || fn == SIG_IGN) {
	handler[sig-1] = (sig_type)0;
	<------------- here
        signal(sig,fn);
    } else {

cause NULL pointer reference when signal comes
"here", but more worse fragment is below:

void handle_signals() {
    int sig;

    if (caused)
       for (sig=0; sig<__MAXSIG; sig++, caused>>=1)
           if (caused&1)
               (*handler[sig])(sig+1);
}

caused is bitmask which set corresponding bit on each signal coming.
And now imagine, what happens when some signal comes (bit sets) while loop
is executed (see caused>>=1 !!!)

In this light carrier drop situation was (as gdb shows)
1. SIGSEGV in handle_signals because some junk called as *handler reference.
2. Since SIGSEGV was pended too (== never happens),
it can cause various range of disasters.

1 files changed, 9 insertions, 14 deletions

diff --git a/usr.sbin/ppp/main.c b/usr.sbin/ppp/main.c
index b3ae332..729af0d 100644
--- a/usr.sbin/ppp/main.c
+++ b/usr.sbin/ppp/main.c
@@ -17,7 +17,7 @@
  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- * $Id: main.c,v 1.34 1997/03/08 10:04:21 ache Exp $
+ * $Id$
  *
  *	TODO:
  *		o Add commands for traffic summary, version display, etc.
@@ -28,9 +28,7 @@
 #include <paths.h>
 #include <sys/time.h>
 #include <termios.h>
-#include <sys/cdefs.h>
 #include <signal.h>
-#include "sig.h"
 #include <sys/wait.h>
 #include <errno.h>
 #include <netdb.h>
@@ -213,8 +211,8 @@ int signo;
 static void
 TerminalCont()
 {
-  pending_signal(SIGCONT, SIG_DFL);
-  pending_signal(SIGTSTP, TerminalStop);
+  (void)signal(SIGCONT, SIG_DFL);
+  (void)signal(SIGTSTP, TerminalStop);
   TtyCommandMode(getpgrp() == tcgetpgrp(0));
 }
 
@@ -222,9 +220,9 @@ static void
 TerminalStop(signo)
 int signo;
 {
-  pending_signal(SIGCONT, TerminalCont);
+  (void)signal(SIGCONT, TerminalCont);
   TtyOldMode();
-  pending_signal(SIGTSTP, SIG_DFL);
+  signal(SIGTSTP, SIG_DFL);
   kill(getpid(), signo);
 }
 
@@ -364,13 +362,13 @@ char **argv;
   if(mode & MODE_INTER)
     {
 #ifdef SIGTSTP
-      pending_signal(SIGTSTP, TerminalStop);
+      signal(SIGTSTP, TerminalStop);
 #endif
 #ifdef SIGTTIN
-      pending_signal(SIGTTIN, TerminalStop);
+      signal(SIGTTIN, TerminalStop);
 #endif
 #ifdef SIGTTOU
-      pending_signal(SIGTTOU, SIG_IGN);
+      signal(SIGTTOU, SIG_IGN);
 #endif
     }
 
@@ -792,8 +790,6 @@ DoLoop()
 #ifndef SIGALRM
     usleep(TICKUNIT);
     TimerService();
-#else
-    handle_signals();
 #endif
 
     /* If there are aren't many packets queued, look for some more. */
@@ -829,8 +825,7 @@ DoLoop()
 
     if ( i < 0 ) {
        if ( errno == EINTR ) {
-          handle_signals();
-          continue;
+          continue;            /* Got a signal - should have been dealt with */
        }
        perror("select");
        break;