ensure tape name and tape commands are not too long. passing too long

commands to the other side could cause problems.
ok guenther tb

diff --git a/bin/mt/mt.c b/bin/mt/mt.c
index 5eba7ef..34065ff 100644 (file)
--- a/bin/mt/mt.c
+++ b/bin/mt/mt.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: mt.c,v 1.38 2015/12/30 14:59:10 tedu Exp $    */
+/*     $OpenBSD: mt.c,v 1.39 2018/07/09 19:38:29 deraadt Exp $ */
 /*     $NetBSD: mt.c,v 1.14.2.1 1996/05/27 15:12:11 mrg Exp $  */
 
 /*
@@ -50,6 +50,7 @@
 #include <string.h>
 #include <unistd.h>
 #include <util.h>
+#include <limits.h>
 
 #include "mt.h"
 
@@ -196,6 +197,9 @@ main(int argc, char *argv[])
 #endif
        }
 
+       if (strlen(tape) >= PATH_MAX)
+               err(1, "tape name too long for protocol");
+
        if (eject) {
                if (insert)
                        comp = &com[COM_RETEN];

diff --git a/bin/mt/mtrmt.c b/bin/mt/mtrmt.c
index 86d9d66..7e9bfe6 100644 (file)
--- a/bin/mt/mtrmt.c
+++ b/bin/mt/mtrmt.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: mtrmt.c,v 1.21 2013/11/21 15:54:45 deraadt Exp $      */
+/*     $OpenBSD: mtrmt.c,v 1.22 2018/07/09 19:38:29 deraadt Exp $      */
 /*     $NetBSD: mtrmt.c,v 1.2 1996/03/06 06:22:07 scottr Exp $ */
 
 /*-
@@ -51,6 +51,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <limits.h>
 
 #include "pathnames.h"
 #include "mt.h"
@@ -174,9 +175,12 @@ okname(char *cp0)
 int
 rmtopen(char *tape, int mode)
 {
-       char buf[256];
+       char buf[1 + PATH_MAX+1 + 10+1 +1];
+       int r;
 
-       (void)snprintf(buf, sizeof (buf), "O%s\n%d\n", tape, mode);
+       r = snprintf(buf, sizeof (buf), "O%s\n%d\n", tape, mode);
+       if (r == -1 || r >= sizeof buf)
+               errx(1, "tape name too long");
        rmtstate = TS_OPEN;
        return (rmtcall(tape, buf));
 }
@@ -210,11 +214,14 @@ rmtstatus(void)
 int
 rmtioctl(int cmd, int count)
 {
-       char buf[256];
+       char buf[1 + 10+1 + 10+1 +1];
+       int r;
 
        if (count < 0)
                return (-1);
-       (void)snprintf(buf, sizeof (buf), "I%d\n%d\n", cmd, count);
+       r = snprintf(buf, sizeof (buf), "I%d\n%d\n", cmd, count);
+       if (r == -1 || r >= sizeof buf)
+               errx(1, "string error during ioctl");
        return (rmtcall("ioctl", buf));
 }