[20186] in bugtraq
Re: ntp-4.0.99k23 had been updated
daemon@ATHENA.MIT.EDU (Sylvain Robitaille)
Fri Apr 13 02:27:02 2001
Message-ID: <200104122124.RAA31899@alcor.concordia.ca>
Date: Thu, 12 Apr 2001 17:24:30 -0400
Reply-To: Sylvain Robitaille <syl@ALCOR.CONCORDIA.CA>
From: Sylvain Robitaille <syl@ALCOR.CONCORDIA.CA>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <20010411112024.A1491@nmt.edu>
William Colburn wrote:
> The package is newer as of today.
True enough, but I have the impression that there are more changes there
than just the area of code that's affected by the buffer overflow that
triggered the start of this thread. Can anyone confirm this?
I've looked and I *believe* the only difference relevant to this
discussion between today's ntp-4.0.99k23 and last Friday's is the
appended patch. If anyone believes there are more relevant differences
could you please point them out?
--
----------------------------------------------------------------------
Sylvain Robitaille syl@alcor.concordia.ca
Systems analyst Concordia University
Instructional & Information Technology Montreal, Quebec, Canada
----------------------------------------------------------------------
--- ntpd/ntp_control.c.20010412 Mon Apr 9 15:47:20 2001
+++ ntpd/ntp_control.c Thu Apr 12 17:11:47 2001
@@ -1759,9 +1759,11 @@
}
if (cp < reqend)
cp++;
- *tp = '\0';
- while (isspace(*(tp-1)))
- *(--tp) = '\0';
+ while (tp > buf) {
+ *tp-- = '\0';
+ if (!isspace((int)(*tp)))
+ break;
+ }
reqpt = cp;
*data = buf;
return v;
