BSD 4_3_Reno release

[unix-history] / usr / src / libexec / tftpd / tftpd.c

diff --git a/usr/src/libexec/tftpd/tftpd.c b/usr/src/libexec/tftpd/tftpd.c
index f4cd20f..6e1bd60 100644 (file)
--- a/usr/src/libexec/tftpd/tftpd.c
+++ b/usr/src/libexec/tftpd/tftpd.c
@@ -3,16 +3,18 @@
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted

- * provided that the above copyright notice and this paragraph are
- * duplicated in all such forms and that any documentation,
- * advertising materials, and other materials related to such
- * distribution and use acknowledge that the software was developed
- * by the University of California, Berkeley.  The name of the
- * University may not be used to endorse or promote products derived
+ * provided that: (1) source distributions retain this entire copyright
+ * notice and comment, and (2) distributions including binaries display
+ * the following acknowledgement:  ``This product includes software
+ * developed by the University of California, Berkeley and its contributors''
+ * in the documentation or other materials provided with the distribution
+ * and in all advertising materials mentioning features or use of this
+ * software. Neither the name of the University nor the names of its
+ * contributors may be used to endorse or promote products derived

  * from this software without specific prior written permission.
  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  * from this software without specific prior written permission.
  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED

- * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

  */
 
 #ifndef lint
  */
 
 #ifndef lint


@@ -22,7 +24,7 @@ char copyright[] =
 #endif /* not lint */
 
 #ifndef lint
 #endif /* not lint */
 
 #ifndef lint

-static char sccsid[] = "@(#)tftpd.c    5.9 (Berkeley) %G%";
+static char sccsid[] = "@(#)tftpd.c    5.12 (Berkeley) 6/1/90";

 #endif /* not lint */
 
 /*
 #endif /* not lint */
 
 /*


@@ -36,18 +38,19 @@ static char sccsid[] = "@(#)tftpd.c 5.9 (Berkeley) %G%";
 #include <sys/ioctl.h>
 #include <sys/wait.h>
 #include <sys/stat.h>
 #include <sys/ioctl.h>
 #include <sys/wait.h>
 #include <sys/stat.h>

+#include <sys/signal.h>

 
 #include <netinet/in.h>
 
 #include <arpa/tftp.h>
 
 
 #include <netinet/in.h>
 
 #include <arpa/tftp.h>
 

-#include <signal.h>
+#include <netdb.h>
+#include <setjmp.h>

 #include <stdio.h>
 #include <errno.h>
 #include <ctype.h>
 #include <stdio.h>
 #include <errno.h>
 #include <ctype.h>

-#include <netdb.h>
-#include <setjmp.h>

 #include <syslog.h>
 #include <syslog.h>

+#include <string.h>

 
 #define        TIMEOUT         5
 
 
 #define        TIMEOUT         5
 


@@ -250,11 +253,17 @@ validate_access(filename, mode)
 {
        struct stat stbuf;
        int     fd;
 {
        struct stat stbuf;
        int     fd;

-       char **dirp = dirs;
+       char *cp, **dirp;

 
        if (*filename != '/')
                return (EACCESS);
 
        if (*filename != '/')
                return (EACCESS);

-       for (; *dirp; dirp++)
+       /*
+        * prevent tricksters from getting around the directory restrictions
+        */
+       for (cp = filename + 1; *cp; cp++)
+               if(*cp == '.' && strncmp(cp-1, "/../", 4) == 0)
+                       return(EACCESS);
+       for (dirp = dirs; *dirp; dirp++)

                if (strncmp(filename, *dirp, strlen(*dirp)) == 0)
                        break;
        if (*dirp==0 && dirp!=dirs)
                if (strncmp(filename, *dirp, strlen(*dirp)) == 0)
                        break;
        if (*dirp==0 && dirp!=dirs)


@@ -460,7 +469,6 @@ nak(error)
        register struct tftphdr *tp;
        int length;
        register struct errmsg *pe;
        register struct tftphdr *tp;
        int length;
        register struct errmsg *pe;

-       extern char *sys_errlist[];

 
        tp = (struct tftphdr *)buf;
        tp->th_opcode = htons((u_short)ERROR);
 
        tp = (struct tftphdr *)buf;
        tp->th_opcode = htons((u_short)ERROR);


@@ -469,7 +477,7 @@ nak(error)
                if (pe->e_code == error)
                        break;
        if (pe->e_code < 0) {
                if (pe->e_code == error)
                        break;
        if (pe->e_code < 0) {

-               pe->e_msg = sys_errlist[error - 100];
+               pe->e_msg = strerror(error - 100);

                tp->th_code = EUNDEF;   /* set 'undef' errorcode */
        }
        strcpy(tp->th_msg, pe->e_msg);
                tp->th_code = EUNDEF;   /* set 'undef' errorcode */
        }
        strcpy(tp->th_msg, pe->e_msg);