[2156] in Athena Bugs
Security fix for "passwd.real"
daemon@ATHENA.MIT.EDU (Ilhamuddin Ahmed)
Wed May 3 12:37:31 1989
Date: Wed, 3 May 89 12:36:23 EDT
From: Ilhamuddin Ahmed <ilham@ATHENA.MIT.EDU>
To: bugs@ATHENA.MIT.EDU
Cc: ilham@ATHENA.MIT.EDU
Reply-To: ilham@ATHENA.MIT.EDU
This is nearly the patch file posted to comp.bugs.4bsd.ucb-fixes, by
Keith Bostic and forwarded by <jtkohl> to bugs. It just has a small
addition for the Athena environment. The patch is as follows and is for
both hardware platforms.
- Ilham
===============================================================================
*** /minos/source/4.3/bin/passwd.c Mon May 16 12:12:36 1988
--- passwd.c Wed May 3 12:29:55 1989
***************
*** 328,333 ****
--- 328,335 ----
return (crypt(pwbuf, saltc));
}
+ #define STRSIZE 100
+
char *
getloginshell(pwd, u, arg)
struct passwd *pwd;
***************
*** 334,340 ****
int u;
char *arg;
{
! static char newshell[BUFSIZ];
char *cp, *valid, *getusershell();
if (pwd->pw_shell == 0 || *pwd->pw_shell == '\0')
--- 336,342 ----
int u;
char *arg;
{
! static char newshell[STRSIZE];
char *cp, *valid, *getusershell();
if (pwd->pw_shell == 0 || *pwd->pw_shell == '\0')
***************
*** 413,421 ****
getfingerinfo(pwd)
struct passwd *pwd;
{
! char in_str[BUFSIZ];
struct default_values *defaults, *get_defaults();
! static char answer[4*BUFSIZ];
answer[0] = '\0';
defaults = get_defaults(pwd->pw_gecos);
--- 415,423 ----
getfingerinfo(pwd)
struct passwd *pwd;
{
! char in_str[STRSIZE];
struct default_values *defaults, *get_defaults();
! static char answer[4*STRSIZE];
answer[0] = '\0';
defaults = get_defaults(pwd->pw_gecos);
***************
*** 427,433 ****
*/
do {
printf("\nName [%s]: ", defaults->name);
! (void) fgets(in_str, BUFSIZ, stdin);
if (special_case(in_str, defaults->name))
break;
} while (illegal_input(in_str));
--- 429,435 ----
*/
do {
printf("\nName [%s]: ", defaults->name);
! (void) fgets(in_str, STRSIZE, stdin);
if (special_case(in_str, defaults->name))
break;
} while (illegal_input(in_str));
***************
*** 437,443 ****
*/
do {
printf("\nNickname [%s]: ", defaults->nickname);
! (void) fgets(in_str, BUFSIZ, stdin);
if (special_case(in_str, defaults->nickname))
break;
} while (illegal_input(in_str));
--- 439,445 ----
*/
do {
printf("\nNickname [%s]: ", defaults->nickname);
! (void) fgets(in_str, STRSIZE, stdin);
if (special_case(in_str, defaults->nickname))
break;
} while (illegal_input(in_str));
***************
*** 448,454 ****
do {
printf("Room number (Exs: 410T or 38-476M) [%s]: ",
defaults->office_num);
! (void) fgets(in_str, BUFSIZ, stdin);
if (special_case(in_str, defaults->office_num))
break;
} while (illegal_input(in_str) || illegal_building(in_str));
--- 450,456 ----
do {
printf("Room number (Exs: 410T or 38-476M) [%s]: ",
defaults->office_num);
! (void) fgets(in_str, STRSIZE, stdin);
if (special_case(in_str, defaults->office_num))
break;
} while (illegal_input(in_str) || illegal_building(in_str));
***************
*** 460,466 ****
do {
printf("Office Phone (Ex: 3-1300) [%s]: ",
defaults->office_phone);
! (void) fgets(in_str, BUFSIZ, stdin);
if (special_case(in_str, defaults->office_phone))
break;
remove_hyphens(in_str);
--- 462,468 ----
do {
printf("Office Phone (Ex: 3-1300) [%s]: ",
defaults->office_phone);
! (void) fgets(in_str, STRSIZE, stdin);
if (special_case(in_str, defaults->office_phone))
break;
remove_hyphens(in_str);
***************
*** 478,484 ****
*/
do {
printf("Home Phone (Ex: 9875432) [%s]: ", defaults->home_phone);
! (void) fgets(in_str, BUFSIZ, stdin);
if (special_case(in_str, defaults->home_phone))
break;
remove_hyphens(in_str);
--- 480,486 ----
*/
do {
printf("Home Phone (Ex: 9875432) [%s]: ", defaults->home_phone);
! (void) fgets(in_str, STRSIZE, stdin);
if (special_case(in_str, defaults->home_phone))
break;
remove_hyphens(in_str);
***************
*** 515,521 ****
if (input_str[length-1] != '\n') {
/* the newline and the '\0' eat up two characters */
printf("Maximum number of characters allowed is %d\n",
! BUFSIZ-2);
/* flush the rest of the input line */
while (getchar() != '\n')
/* void */;
--- 517,523 ----
if (input_str[length-1] != '\n') {
/* the newline and the '\0' eat up two characters */
printf("Maximum number of characters allowed is %d\n",
! STRSIZE-2);
/* flush the rest of the input line */
while (getchar() != '\n')
/* void */;
