From nobody@FreeBSD.org  Thu Jan  8 13:18:47 2009
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 02FB21065675
	for <freebsd-gnats-submit@FreeBSD.org>; Thu,  8 Jan 2009 13:18:47 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id E4CC98FC19
	for <freebsd-gnats-submit@FreeBSD.org>; Thu,  8 Jan 2009 13:18:46 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n08DIks6021839
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 8 Jan 2009 13:18:46 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id n08DIkuj021838;
	Thu, 8 Jan 2009 13:18:46 GMT
	(envelope-from nobody)
Message-Id: <200901081318.n08DIkuj021838@www.freebsd.org>
Date: Thu, 8 Jan 2009 13:18:46 GMT
From: Yonggang Li <leeygang@gmail.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: netstat crash when params is incorrect
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         130300
>Category:       bin
>Synopsis:       [patch] netstat(1) crash when params is incorrect
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jan 08 13:20:02 UTC 2009
>Closed-Date:    Sat Jan 10 12:35:15 UTC 2009
>Last-Modified:  Tue Jan 13 01:10:01 UTC 2009
>Originator:     Yonggang Li
>Release:        7.0 Release
>Organization:
>Environment:
FreeBSD freebsd.dlink-li 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Sun Feb 24 19:59:52 UTC 2008     root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386

>Description:
netstat crash when input:
  netstat -m XXX
XXX means any string.
>How-To-Repeat:
refer to Full Description.
>Fix:
it is caused by the code in /usr/src/usr.bin/netstat/main.c: main function

#define	BACKWARD_COMPATIBILITY
#ifdef	BACKWARD_COMPATIBILITY
	if (*argv) {
		if (isdigit(**argv)) {
			interval = atoi(*argv);
			if (interval <= 0)
				usage();
			++argv;
			iflag = 1;
		}
		if (*argv) {
			nlistf = *argv;
			if (*++argv)
				memf = *argv;
		}
	}
#endif

this backward_compatibility code can not recognize the incorrect params, but the internal flags(nlistf,memf) are set incorrectly instead.
And if this code is obsolete, I suggest delete this code and add params check.

Patch attached with submission follows:

*** main.c	Tue Jan  6 15:01:25 2009
--- ../main.c	Thu Jan  8 13:16:43 2009
***************
*** 465,489 ****
  		}
  	argv += optind;
  	argc -= optind;
! 
! #define	BACKWARD_COMPATIBILITY
! #ifdef	BACKWARD_COMPATIBILITY
! 	if (*argv) {
! 		if (isdigit(**argv)) {
! 			interval = atoi(*argv);
! 			if (interval <= 0)
! 				usage();
! 			++argv;
! 			iflag = 1;
! 		}
! 		if (*argv) {
! 			nlistf = *argv;
! 			if (*++argv)
! 				memf = *argv;
! 		}
! 	}
! #endif
! 
  	/*
  	 * Discard setgid privileges if not the running kernel so that bad
  	 * guys can't print interesting stuff from kernel memory.
--- 465,475 ----
  		}
  	argv += optind;
  	argc -= optind;
!     /*
!      * Params should be parsed without error.
!      * */
!     if(argv)
!         usage();    
  	/*
  	 * Discard setgid privileges if not the running kernel so that bad
  	 * guys can't print interesting stuff from kernel memory.


>Release-Note:
>Audit-Trail:

From: "Li yonggang" <leeygang@gmail.com>
To: FreeBSD-gnats-submit@freebsd.org, freebsd-bugs@freebsd.org
Cc:  
Subject: Re: bin/130300: netstat crash when params is incorrect
Date: Thu, 8 Jan 2009 14:03:58 +0000

 ------=_Part_228846_30793095.1231423439011
 Content-Type: text/plain; charset=ISO-8859-1
 Content-Transfer-Encoding: 7bit
 Content-Disposition: inline
 
 correct the patch files:).
 
 ------=_Part_228846_30793095.1231423439011
 Content-Type: text/plain; name=main.txt
 Content-Transfer-Encoding: base64
 X-Attachment-Id: file0
 Content-Disposition: attachment; filename=main.txt
 
 KioqIG1haW4uYwlUdWUgSmFuICA2IDE1OjAxOjI1IDIwMDkKLS0tIC4uL21haW4uYwlUaHUgSmFu
 ICA4IDEzOjU3OjM4IDIwMDkKKioqKioqKioqKioqKioqCioqKiAzNDEsMzQ2ICoqKioKLS0tIDM0
 MSwzNDcgLS0tLQogIGludAlhZjsJCS8qIGFkZHJlc3MgZmFtaWx5ICovCiAgaW50CWxpdmU7CQkv
 KiB0cnVlIGlmIHdlIGFyZSBleGFtaW5pbmcgYSBsaXZlIHN5c3RlbSAqLwogIAorIAogIGludAog
 IG1haW4oaW50IGFyZ2MsIGNoYXIgKmFyZ3ZbXSkKICB7CioqKioqKioqKioqKioqKgoqKiogNDYz
 LDQ4OSAqKioqCiAgCQlkZWZhdWx0OgogIAkJCXVzYWdlKCk7CiAgCQl9CiEgCWFyZ3YgKz0gb3B0
 aW5kOwohIAlhcmdjIC09IG9wdGluZDsKISAKISAjZGVmaW5lCUJBQ0tXQVJEX0NPTVBBVElCSUxJ
 VFkKISAjaWZkZWYJQkFDS1dBUkRfQ09NUEFUSUJJTElUWQohIAlpZiAoKmFyZ3YpIHsKISAJCWlm
 IChpc2RpZ2l0KCoqYXJndikpIHsKISAJCQlpbnRlcnZhbCA9IGF0b2koKmFyZ3YpOwohIAkJCWlm
 IChpbnRlcnZhbCA8PSAwKQohIAkJCQl1c2FnZSgpOwohIAkJCSsrYXJndjsKISAJCQlpZmxhZyA9
 IDE7CiEgCQl9CiEgCQlpZiAoKmFyZ3YpIHsKISAJCQlubGlzdGYgPSAqYXJndjsKISAJCQlpZiAo
 KisrYXJndikKISAJCQkJbWVtZiA9ICphcmd2OwohIAkJfQohIAl9CiEgI2VuZGlmCiEgCiAgCS8q
 CiAgCSAqIERpc2NhcmQgc2V0Z2lkIHByaXZpbGVnZXMgaWYgbm90IHRoZSBydW5uaW5nIGtlcm5l
 bCBzbyB0aGF0IGJhZAogIAkgKiBndXlzIGNhbid0IHByaW50IGludGVyZXN0aW5nIHN0dWZmIGZy
 b20ga2VybmVsIG1lbW9yeS4KLS0tIDQ2NCw0NzQgLS0tLQogIAkJZGVmYXVsdDoKICAJCQl1c2Fn
 ZSgpOwogIAkJfQohICAgICAvKgohICAgICAgKiBQYXJhbXMgc2hvdWxkIGJlIHBhcnNlZCB3aXRo
 b3V0IGVycm9yLgohICAgICAgKiAqLwohICAgICBpZigqKGFyZ3YgKz0gb3B0aW5kKSkKISAgICAg
 ICAgIHVzYWdlKCk7CiAgCS8qCiAgCSAqIERpc2NhcmQgc2V0Z2lkIHByaXZpbGVnZXMgaWYgbm90
 IHRoZSBydW5uaW5nIGtlcm5lbCBzbyB0aGF0IGJhZAogIAkgKiBndXlzIGNhbid0IHByaW50IGlu
 dGVyZXN0aW5nIHN0dWZmIGZyb20ga2VybmVsIG1lbW9yeS4K
 ------=_Part_228846_30793095.1231423439011--

From: Jaakko Heinonen <jh@saunalahti.fi>
To: bug-followup@FreeBSD.org, leeygang@gmail.com
Cc:  
Subject: Re: bin/130300: netstat crash when params is incorrect
Date: Thu, 8 Jan 2009 22:32:43 +0200

 This is a duplicate of bin/124724.
 
 -- 
 Jaakko
State-Changed-From-To: open->closed 
State-Changed-By: ru 
State-Changed-When: Sat Jan 10 12:34:46 UTC 2009 
State-Changed-Why:  
Duplicate of bin/124724. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=130300 

From: Ruslan Ermilov <ru@FreeBSD.org>
To: Li yonggang <leeygang@gmail.com>
Cc: bug-followup@FreeBSD.org
Subject: Re: bin/130300: netstat crash when params is incorrect
Date: Sat, 10 Jan 2009 15:31:30 +0300

 The problem is not with the backward compatibility code -- you'll
 get the same crash with "netstat -N foo -m" as well.  The proper
 fix is as follows:
 
 %%%
 Index: main.c
 ===================================================================
 RCS file: /home/ncvs/src/usr.bin/netstat/main.c,v
 retrieving revision 1.87.2.1
 diff -u -p -r1.87.2.1 main.c
 --- main.c	16 Mar 2008 07:20:18 -0000	1.87.2.1
 +++ main.c	10 Jan 2009 12:25:32 -0000
 @@ -499,7 +499,7 @@ main(int argc, char *argv[])
  		exit(0);
  	}
  	if (mflag) {
 -		if (memf != NULL) {
 +		if (!live) {
  			if (kread(0, NULL, 0) == 0)
  				mbpr(kvmd, nl[N_MBSTAT].n_value);
  		} else
 %%%
 
 
 Cheers,
 -- 
 Ruslan Ermilov
 ru@FreeBSD.org
 FreeBSD committer

From: "Li yonggang" <leeygang@gmail.com>
To: "Ruslan Ermilov" <ru@freebsd.org>
Cc: bug-followup@freebsd.org
Subject: Re: bin/130300: netstat crash when params is incorrect
Date: Sat, 10 Jan 2009 22:01:19 +0800

 I dont think netstat -N foo -m and netstat -m foo are exactly the same bug.
 the crash of netstat -N foo -m is caused by not providing -M option to
 specify the dump file, while the crash of netstat -m foo is caused not
 check illegal params.
 but I agree to fix them  in bug 124724 together.
 
 
 On Sat, Jan 10, 2009 at 8:31 PM, Ruslan Ermilov <ru@freebsd.org> wrote:
 > The problem is not with the backward compatibility code -- you'll
 > get the same crash with "netstat -N foo -m" as well.  The proper
 > fix is as follows:
 >
 > %%%
 > Index: main.c
 > ===================================================================
 > RCS file: /home/ncvs/src/usr.bin/netstat/main.c,v
 > retrieving revision 1.87.2.1
 > diff -u -p -r1.87.2.1 main.c
 > --- main.c      16 Mar 2008 07:20:18 -0000      1.87.2.1
 > +++ main.c      10 Jan 2009 12:25:32 -0000
 > @@ -499,7 +499,7 @@ main(int argc, char *argv[])
 >                exit(0);
 >        }
 >        if (mflag) {
 > -               if (memf != NULL) {
 > +               if (!live) {
 >                        if (kread(0, NULL, 0) == 0)
 >                                mbpr(kvmd, nl[N_MBSTAT].n_value);
 >                } else
 > %%%
 >
 >
 > Cheers,
 > --
 > Ruslan Ermilov
 > ru@FreeBSD.org
 > FreeBSD committer
 >

From: "Li yonggang" <leeygang@gmail.com>
To: "Ruslan Ermilov" <ru@freebsd.org>
Cc: bug-followup@freebsd.org
Subject: Re: bin/130300: netstat crash when params is incorrect
Date: Tue, 13 Jan 2009 01:02:06 +0000

 the fix from Ruslan Ermilov works for netstat -m foo.
 but I still think there MUST be a check for illegal params input.
 because in netstat -m foo, the live variable will be set 0 by mistake,
 there is no any reason to continue, because the further call kread
 will use illegal input: foo. we should stop at usage() when illegal
 params input is found. this will apply for all the params input not
 only -m foo, which will help reduce the possibility of the regression
 like -m foo.
 
 %%%
 Index:main.c
 
 =================================================
 --- main.c	2009-01-12 15:13:06.000000000 +0000
 +++ ../main.c	2009-01-12 15:32:14.000000000 +0000
 @@ -341,6 +341,7 @@
  int	af;		/* address family */
  int	live;		/* true if we are examining a live system */
 
 +
  int
  main(int argc, char *argv[])
  {
 @@ -463,28 +464,12 @@
  		default:
  			usage();
  		}
 -	argv += optind;
 -	argc -= optind;
 -
 -#define	BACKWARD_COMPATIBILITY
 -#ifdef	BACKWARD_COMPATIBILITY
 -	if (*argv) {
 -		if (isdigit(**argv)) {
 -			interval = atoi(*argv);
 -			if (interval <= 0)
 -				usage();
 -			++argv;
 -			iflag = 1;
 -		}
 -		if (*argv) {
 -			nlistf = *argv;
 -			if (*++argv)
 -				memf = *argv;
 -		}
 -	}
 -#endif
 -
 -	/*
 +    /*
 +     * Params should be parsed without error.
 +     * */
 +    if(*(argv += optind))
 +        usage();
 +    /*
  	 * Discard setgid privileges if not the running kernel so that bad
  	 * guys can't print interesting stuff from kernel memory.
  	 */
 %%%
 
 Thanks,
 Yonggang Li
>Unformatted:
