Further harden glibc malloc metadata against 1-byte overflows.
[glibc.git] / inet / rexec.c
blob43fb67bcf2c6d4fdff9e8dcd053786ab523f7aa1
1 /*
2 * Copyright (c) 1980, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 4. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
30 #include <sys/types.h>
31 #include <sys/socket.h>
33 #include <netinet/in.h>
35 #include <alloca.h>
36 #include <stdio.h>
37 #include <netdb.h>
38 #include <errno.h>
39 #include <stdlib.h>
40 #include <string.h>
41 #include <unistd.h>
42 #include <sys/uio.h>
44 int rexecoptions;
45 libc_freeres_ptr (static char *ahostbuf);
47 int
48 rexec_af (char **ahost, int rport, const char *name, const char *pass,
49 const char *cmd, int *fd2p, sa_family_t af)
51 struct sockaddr_storage from;
52 struct addrinfo hints, *res0;
53 const char *orig_name = name;
54 const char *orig_pass = pass;
55 u_short port = 0;
56 int s, timo = 1, s3;
57 char c;
58 int gai;
59 char servbuff[NI_MAXSERV];
61 __snprintf(servbuff, sizeof(servbuff), "%d", ntohs(rport));
62 servbuff[sizeof(servbuff) - 1] = '\0';
64 memset(&hints, '\0', sizeof(hints));
65 hints.ai_family = af;
66 hints.ai_socktype = SOCK_STREAM;
67 hints.ai_flags = AI_CANONNAME;
68 gai = getaddrinfo(*ahost, servbuff, &hints, &res0);
69 if (gai){
70 /* XXX: set errno? */
71 return -1;
74 if (res0->ai_canonname){
75 free (ahostbuf);
76 ahostbuf = __strdup (res0->ai_canonname);
77 if (ahostbuf == NULL) {
78 perror ("rexec: strdup");
79 return (-1);
81 *ahost = ahostbuf;
82 } else {
83 *ahost = NULL;
84 __set_errno (ENOENT);
85 return -1;
87 ruserpass(res0->ai_canonname, &name, &pass);
88 retry:
89 s = __socket(res0->ai_family, res0->ai_socktype, 0);
90 if (s < 0) {
91 perror("rexec: socket");
92 return (-1);
94 if (__connect(s, res0->ai_addr, res0->ai_addrlen) < 0) {
95 if (errno == ECONNREFUSED && timo <= 16) {
96 (void) __close(s);
97 __sleep(timo);
98 timo *= 2;
99 goto retry;
101 perror(res0->ai_canonname);
102 return (-1);
104 if (fd2p == 0) {
105 (void) __write(s, "", 1);
106 port = 0;
107 } else {
108 char num[32];
109 int s2;
110 union
112 struct sockaddr_storage ss;
113 struct sockaddr sa;
114 } sa2;
115 socklen_t sa2len;
117 s2 = __socket(res0->ai_family, res0->ai_socktype, 0);
118 if (s2 < 0) {
119 (void) __close(s);
120 return (-1);
122 __listen(s2, 1);
123 sa2len = sizeof (sa2);
124 if (__getsockname(s2, &sa2.sa, &sa2len) < 0) {
125 perror("getsockname");
126 (void) __close(s2);
127 goto bad;
128 } else if (sa2len != SA_LEN(&sa2.sa)) {
129 __set_errno(EINVAL);
130 (void) __close(s2);
131 goto bad;
133 port = 0;
134 if (!getnameinfo(&sa2.sa, sa2len,
135 NULL, 0, servbuff, sizeof(servbuff),
136 NI_NUMERICSERV))
137 port = atoi(servbuff);
138 (void) sprintf(num, "%u", port);
139 (void) __write(s, num, strlen(num)+1);
140 { socklen_t len = sizeof (from);
141 s3 = TEMP_FAILURE_RETRY (accept(s2, (struct sockaddr *)&from,
142 &len));
143 __close(s2);
144 if (s3 < 0) {
145 perror("accept");
146 port = 0;
147 goto bad;
150 *fd2p = s3;
153 struct iovec iov[3] =
155 [0] = { .iov_base = (void *) name, .iov_len = strlen (name) + 1 },
156 /* should public key encypt the password here */
157 [1] = { .iov_base = (void *) pass, .iov_len = strlen (pass) + 1 },
158 [2] = { .iov_base = (void *) cmd, .iov_len = strlen (cmd) + 1 }
160 (void) TEMP_FAILURE_RETRY (__writev (s, iov, 3));
162 /* We don't need the memory allocated for the name and the password
163 in ruserpass anymore. */
164 if (name != orig_name)
165 free ((char *) name);
166 if (pass != orig_pass)
167 free ((char *) pass);
169 if (__read(s, &c, 1) != 1) {
170 perror(*ahost);
171 goto bad;
173 if (c != 0) {
174 while (__read(s, &c, 1) == 1) {
175 (void) __write(2, &c, 1);
176 if (c == '\n')
177 break;
179 goto bad;
181 freeaddrinfo(res0);
182 return (s);
183 bad:
184 if (port)
185 (void) __close(*fd2p);
186 (void) __close(s);
187 freeaddrinfo(res0);
188 return (-1);
190 libc_hidden_def (rexec_af)
193 rexec (char **ahost, int rport, const char *name, const char *pass,
194 const char *cmd, int *fd2p)
196 return rexec_af(ahost, rport, name, pass, cmd, fd2p, AF_INET);