0001064: telnetd segfault when using devpts and /dev/pts is not mounted

BusyBox Bug and Patch Tracking

Viewing Issue Simple Details [ Jump to Notes ]

[ View Advanced ] [ Issue History ] [ Print ]

Category

Severity

Reproducibility

Date Submitted

Last Update

0001064

[BusyBox] Networking Support

minor

always

10-05-06 01:54

10-15-06 11:22

Reporter

ydirson

View Status

public

Assigned To

BusyBox

Priority

normal

Resolution

fixed

Status

closed

Product Version

1.2.x

Summary

0001064: telnetd segfault when using devpts and /dev/pts is not mounted

Description

In telnetd.c:getpty(), the return value of ptsname() is passed to strcpy() without a check, while it is documented as returning NULL on error. This happens for example if the kernel was compiled with UNIX98 PTY support (so openning /dev/ptmx works), and /dev/pts is not mounted.

Additional Information

Changing that part of the code to the following does catch the error. It would surely be better to use syslog() to report the error, though.

        if (p > 0) {
                char* pts;
                grantpt(p);
                unlockpt(p);
                pts = ptsname(p);
                if (!pts) {
                        fprintf(stderr, "Failed to get pts: %s\n", strerror(errno));
                        return -1;
                }
                strcpy(line, ptsname(p));
                return(p);
        }

Attached Files

Relationships

Notes
(0001703) vda 10-15-06 11:22	Fixed in rev 16391

Issue History
Date Modified	Username	Field	Change
10-05-06 01:54	ydirson	New Issue
10-05-06 01:54	ydirson	Status	new => assigned
10-05-06 01:54	ydirson	Assigned To	=> BusyBox
10-15-06 11:22	vda	Status	assigned => closed
10-15-06 11:22	vda	Note Added: 0001703
10-15-06 11:22	vda	Resolution	open => fixed