re_search_internal: Avoid overflow in computing re_malloc buffer size
[glibc.git] / inet / rexec.c
blob75bb47082b3fa4f2cf7688b81b396f1eefebaf63
1 /*
2 * Copyright (c) 1980, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 4. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
30 #if defined(LIBC_SCCS) && !defined(lint)
31 static char sccsid[] = "@(#)rexec.c 8.1 (Berkeley) 6/4/93";
32 #endif /* LIBC_SCCS and not lint */
34 #include <sys/types.h>
35 #include <sys/socket.h>
37 #include <netinet/in.h>
39 #include <alloca.h>
40 #include <stdio.h>
41 #include <netdb.h>
42 #include <errno.h>
43 #include <stdlib.h>
44 #include <string.h>
45 #include <unistd.h>
46 #include <sys/uio.h>
48 int rexecoptions;
49 libc_freeres_ptr (static char *ahostbuf);
51 int
52 rexec_af(ahost, rport, name, pass, cmd, fd2p, af)
53 char **ahost;
54 int rport;
55 const char *name, *pass, *cmd;
56 int *fd2p;
57 sa_family_t af;
59 struct sockaddr_storage from;
60 struct addrinfo hints, *res0;
61 const char *orig_name = name;
62 const char *orig_pass = pass;
63 u_short port = 0;
64 int s, timo = 1, s3;
65 char c;
66 int gai;
67 char servbuff[NI_MAXSERV];
69 __snprintf(servbuff, sizeof(servbuff), "%d", ntohs(rport));
70 servbuff[sizeof(servbuff) - 1] = '\0';
72 memset(&hints, '\0', sizeof(hints));
73 hints.ai_family = af;
74 hints.ai_socktype = SOCK_STREAM;
75 hints.ai_flags = AI_CANONNAME;
76 gai = getaddrinfo(*ahost, servbuff, &hints, &res0);
77 if (gai){
78 /* XXX: set errno? */
79 return -1;
82 if (res0->ai_canonname){
83 free (ahostbuf);
84 ahostbuf = strdup (res0->ai_canonname);
85 if (ahostbuf == NULL) {
86 perror ("rexec: strdup");
87 return (-1);
89 *ahost = ahostbuf;
90 } else {
91 *ahost = NULL;
92 __set_errno (ENOENT);
93 return -1;
95 ruserpass(res0->ai_canonname, &name, &pass);
96 retry:
97 s = __socket(res0->ai_family, res0->ai_socktype, 0);
98 if (s < 0) {
99 perror("rexec: socket");
100 return (-1);
102 if (__connect(s, res0->ai_addr, res0->ai_addrlen) < 0) {
103 if (errno == ECONNREFUSED && timo <= 16) {
104 (void) __close(s);
105 __sleep(timo);
106 timo *= 2;
107 goto retry;
109 perror(res0->ai_canonname);
110 return (-1);
112 if (fd2p == 0) {
113 (void) __write(s, "", 1);
114 port = 0;
115 } else {
116 char num[32];
117 int s2;
118 union
120 struct sockaddr_storage ss;
121 struct sockaddr sa;
122 } sa2;
123 socklen_t sa2len;
125 s2 = __socket(res0->ai_family, res0->ai_socktype, 0);
126 if (s2 < 0) {
127 (void) __close(s);
128 return (-1);
130 __listen(s2, 1);
131 sa2len = sizeof (sa2);
132 if (__getsockname(s2, &sa2.sa, &sa2len) < 0) {
133 perror("getsockname");
134 (void) __close(s2);
135 goto bad;
136 } else if (sa2len != SA_LEN(&sa2.sa)) {
137 __set_errno(EINVAL);
138 (void) __close(s2);
139 goto bad;
141 port = 0;
142 if (!getnameinfo(&sa2.sa, sa2len,
143 NULL, 0, servbuff, sizeof(servbuff),
144 NI_NUMERICSERV))
145 port = atoi(servbuff);
146 (void) sprintf(num, "%u", port);
147 (void) __write(s, num, strlen(num)+1);
148 { socklen_t len = sizeof (from);
149 s3 = TEMP_FAILURE_RETRY (accept(s2, (struct sockaddr *)&from,
150 &len));
151 __close(s2);
152 if (s3 < 0) {
153 perror("accept");
154 port = 0;
155 goto bad;
158 *fd2p = s3;
161 struct iovec iov[3] =
163 [0] = { .iov_base = (void *) name, .iov_len = strlen (name) + 1 },
164 /* should public key encypt the password here */
165 [1] = { .iov_base = (void *) pass, .iov_len = strlen (pass) + 1 },
166 [2] = { .iov_base = (void *) cmd, .iov_len = strlen (cmd) + 1 }
168 (void) TEMP_FAILURE_RETRY (__writev (s, iov, 3));
170 /* We don't need the memory allocated for the name and the password
171 in ruserpass anymore. */
172 if (name != orig_name)
173 free ((char *) name);
174 if (pass != orig_pass)
175 free ((char *) pass);
177 if (__read(s, &c, 1) != 1) {
178 perror(*ahost);
179 goto bad;
181 if (c != 0) {
182 while (__read(s, &c, 1) == 1) {
183 (void) __write(2, &c, 1);
184 if (c == '\n')
185 break;
187 goto bad;
189 freeaddrinfo(res0);
190 return (s);
191 bad:
192 if (port)
193 (void) __close(*fd2p);
194 (void) __close(s);
195 freeaddrinfo(res0);
196 return (-1);
198 libc_hidden_def (rexec_af)
201 rexec(ahost, rport, name, pass, cmd, fd2p)
202 char **ahost;
203 int rport;
204 const char *name, *pass, *cmd;
205 int *fd2p;
207 return rexec_af(ahost, rport, name, pass, cmd, fd2p, AF_INET);