From peterjeremy@optushome.com.au  Wed Dec 25 20:40:31 2002
Return-Path: <peterjeremy@optushome.com.au>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id CF57837B401
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 25 Dec 2002 20:40:31 -0800 (PST)
Received: from c18609.belrs1.nsw.optusnet.com.au (c18609.belrs1.nsw.optusnet.com.au [210.49.80.204])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6C61A43ED1
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 25 Dec 2002 20:40:30 -0800 (PST)
	(envelope-from peterjeremy@optushome.com.au)
Received: from server.c18609.belrs1.nsw.optusnet.com.au (localhost.c18609.belrs1.nsw.optusnet.com.au [127.0.0.1])
	by server.c18609.belrs1.nsw.optusnet.com.au (8.12.6/8.12.6) with ESMTP id gBQ4eMhk064589;
	Thu, 26 Dec 2002 15:40:22 +1100 (EST)
	(envelope-from peter@server.c18609.belrs1.nsw.optusnet.com.au)
Received: (from peter@localhost)
	by server.c18609.belrs1.nsw.optusnet.com.au (8.12.6/8.12.6/Submit) id gBQ4eKUa064588;
	Thu, 26 Dec 2002 15:40:20 +1100 (EST)
Message-Id: <200212260440.gBQ4eKUa064588@server.c18609.belrs1.nsw.optusnet.com.au>
Date: Thu, 26 Dec 2002 15:40:20 +1100 (EST)
From: Peter Jeremy <peterjeremy@optushome.com.au>
Reply-To: Peter Jeremy <peterjeremy@optushome.com.au>
To: FreeBSD-gnats-submit@freebsd.org, christos@zoulas.com
Subject: Inadequate validity checking on args to tcsh builtin 'kill'
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         46533
>Category:       bin
>Synopsis:       Inadequate validity checking on args to tcsh builtin 'kill'
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Dec 25 20:50:01 PST 2002
>Closed-Date:    Sat Jul 12 23:52:05 PDT 2003
>Last-Modified:  Sat Jul 12 23:52:05 PDT 2003
>Originator:     Peter Jeremy
>Release:        FreeBSD 4.7-PRERELEASE i386
>Organization:
n/a
>Environment:
System: FreeBSD server.c18609.belrs1.nsw.optusnet.com.au 4.7-PRERELEASE FreeBSD 4.7-PRERELEASE #4: Sat Sep 14 15:07:16 EST 2002 root@server.c18609.belrs1.nsw.optusnet.com.au:/usr/obj/usr/src/sys/server i386

tcsh: $Id: sh.proc.c,v 3.76 2002/03/08 17:36:46 christos Exp $

>Description:
	The `kill' builtin in tcsh uses atoi(3) to parse numeric arguments
	(pids or signals).  As long as an argument begins with a digit,
	it is treated as a valid number, even if it contains non-numeric
	characters.  This bug does not exist in /bin/kill or zsh.
>How-To-Repeat:
	I found the bug when I accidently entered
	# kill 1q5808
	as root and found my remote shell (and the entire system) died.
>Fix:
Index: sh.proc.c
===================================================================
RCS file: /usr/ncvs/src/contrib/tcsh/sh.proc.c,v
retrieving revision 1.1.1.1.2.4
diff -u -r1.1.1.1.2.4 sh.proc.c
--- sh.proc.c	10 Aug 2002 18:14:45 -0000	1.1.1.1.2.4
+++ sh.proc.c	26 Dec 2002 04:25:36 -0000
@@ -1536,6 +1536,7 @@
     register int signum, len = 0;
     register char *name;
     Char *sigptr;
+    char *ep;
     extern int T_Cols;
     extern int nsig;
 
@@ -1566,8 +1567,8 @@
  	    }
  	}
  	if (Isdigit(*sigptr)) {
- 	    signum = atoi(short2str(sigptr));
-	    if (signum < 0 || signum > (MAXSIG-1))
+ 	    signum = strtol(short2str(sigptr), &ep, 10);
+	    if (signum < 0 || signum > (MAXSIG-1) || *ep)
 		stderror(ERR_NAME | ERR_BADSIG);
 	}
 	else {
@@ -1598,6 +1599,7 @@
     sigmask_t omask;
 #endif /* BSDSIGS */
     Char   *cp, **vp;
+    char   *ep;
 
 #ifdef BSDSIGS
     omask = sigmask(SIGCHLD);
@@ -1678,11 +1680,16 @@
 	    stderror(ERR_NAME | ERR_JOBARGS);
 	else {
 #ifndef WINNT_NATIVE
-	    pid = atoi(short2str(cp));
+	    pid = strtol(short2str(cp), &ep, 10);
 #else
-		pid = strtoul(short2str(cp),NULL,0);
+		pid = strtoul(short2str(cp),&ep,0);
 #endif /* WINNT_NATIVE */
-	    if (kill(pid, signum) < 0) {
+	    if (*ep) {
+		xprintf("%S: Badly formed number\n", cp);
+		err1++;
+		goto cont;
+	    }
+	    else if (kill(pid, signum) < 0) {
 		xprintf("%d: %s\n", pid, strerror(errno));
 		err1++;
 		goto cont;
>Release-Note:
>Audit-Trail:

From: Ceri Davies <ceri@FreeBSD.org>
To: FreeBSD Gnats Submit <freebsd-gnats-submit@FreeBSD.org>
Cc:  
Subject: Re: bin/46533: Inadequate validity checking on args to tcsh builtin 'kill'
Date: Wed, 1 Jan 2003 19:49:00 +0000

 Adding to audit trail; obtained from misfiled PR 46542:
 
 On Thu, Dec 26, 2002 at 06:48:51AM -0500, Christos Zoulas wrote:
 >  On Dec 26,  3:40pm, peterjeremy@optushome.com.au (Peter Jeremy) wrote:
 >  -- Subject: Inadequate validity checking on args to tcsh builtin 'kill'
 >  
 >  Thanks, I'll put it in.
 >  
 >  christos
 >  
 >  | 
 >  | >Submitter-Id:	current-users
 >  | >Originator:	Peter Jeremy
 >  | >Organization:	n/a
 >  | >Confidential:	no 
 >  | >Synopsis:	Inadequate validity checking on args to tcsh builtin 'kill'
 >  | >Severity:	serious
 >  | >Priority:	low
 >  | >Category:	bin
 >  | >Class:		sw-bug
 >  | >Release:	FreeBSD 4.7-PRERELEASE i386
 >  | >Environment:
 >  | System: FreeBSD server.c18609.belrs1.nsw.optusnet.com.au 4.7-PRERELEASE FreeBSD 4.7-PRERELEASE #4: Sat Sep 14 15:07:16 EST 2002 root@server.c18609.belrs1.nsw.optusnet.com.au:/usr/obj/usr/src/sys/server i386
 >  | 
 >  | tcsh: $Id: sh.proc.c,v 3.76 2002/03/08 17:36:46 christos Exp $
 >  | 
 >  | >Description:
 >  | 	The `kill' builtin in tcsh uses atoi(3) to parse numeric arguments
 >  | 	(pids or signals).  As long as an argument begins with a digit,
 >  | 	it is treated as a valid number, even if it contains non-numeric
 >  | 	characters.  This bug does not exist in /bin/kill or zsh.
 >  | >How-To-Repeat:
 >  | 	I found the bug when I accidently entered
 >  | 	# kill 1q5808
 >  | 	as root and found my remote shell (and the entire system) died.
 >  | >Fix:
 >  | Index: sh.proc.c
 >  | ===================================================================
 >  | RCS file: /usr/ncvs/src/contrib/tcsh/sh.proc.c,v
 >  | retrieving revision 1.1.1.1.2.4
 >  | diff -u -r1.1.1.1.2.4 sh.proc.c
 >  | --- sh.proc.c	10 Aug 2002 18:14:45 -0000	1.1.1.1.2.4
 >  | +++ sh.proc.c	26 Dec 2002 04:25:36 -0000
 >  | @@ -1536,6 +1536,7 @@
 >  |      register int signum, len = 0;
 >  |      register char *name;
 >  |      Char *sigptr;
 >  | +    char *ep;
 >  |      extern int T_Cols;
 >  |      extern int nsig;
 >  |  
 >  | @@ -1566,8 +1567,8 @@
 >  |   	    }
 >  |   	}
 >  |   	if (Isdigit(*sigptr)) {
 >  | - 	    signum = atoi(short2str(sigptr));
 >  | -	    if (signum < 0 || signum > (MAXSIG-1))
 >  | + 	    signum = strtol(short2str(sigptr), &ep, 10);
 >  | +	    if (signum < 0 || signum > (MAXSIG-1) || *ep)
 >  |  		stderror(ERR_NAME | ERR_BADSIG);
 >  |  	}
 >  |  	else {
 >  | @@ -1598,6 +1599,7 @@
 >  |      sigmask_t omask;
 >  |  #endif /* BSDSIGS */
 >  |      Char   *cp, **vp;
 >  | +    char   *ep;
 >  |  
 >  |  #ifdef BSDSIGS
 >  |      omask = sigmask(SIGCHLD);
 >  | @@ -1678,11 +1680,16 @@
 >  |  	    stderror(ERR_NAME | ERR_JOBARGS);
 >  |  	else {
 >  |  #ifndef WINNT_NATIVE
 >  | -	    pid = atoi(short2str(cp));
 >  | +	    pid = strtol(short2str(cp), &ep, 10);
 >  |  #else
 >  | -		pid = strtoul(short2str(cp),NULL,0);
 >  | +		pid = strtoul(short2str(cp),&ep,0);
 >  |  #endif /* WINNT_NATIVE */
 >  | -	    if (kill(pid, signum) < 0) {
 >  | +	    if (*ep) {
 >  | +		xprintf("%S: Badly formed number\n", cp);
 >  | +		err1++;
 >  | +		goto cont;
 >  | +	    }
 >  | +	    else if (kill(pid, signum) < 0) {
 >  |  		xprintf("%d: %s\n", pid, strerror(errno));
 >  |  		err1++;
 >  |  		goto cont;
 >  -- End of excerpt from Peter Jeremy
State-Changed-From-To: open->closed 
State-Changed-By: kris 
State-Changed-When: Sat Jul 12 23:50:58 PDT 2003 
State-Changed-Why:  
Patch accepted by vendor 

http://www.freebsd.org/cgi/query-pr.cgi?pr=46533 
>Unformatted:
