Bug 208007 - [patch] Int overflow in dhclient(1)
Summary: [patch] Int overflow in dhclient(1)
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: Alan Somers
URL:
Keywords: patch
Depends on:
Blocks:
 
Reported: 2016-03-15 06:29 UTC by Hiren Panchasara
Modified: 2018-01-12 00:09 UTC (History)
2 users (show)

See Also:
asomers: mfc-stable11+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Hiren Panchasara freebsd_committer freebsd_triage 2016-03-15 06:29:03 UTC 
Date: Mon, 14 Mar 2016 21:55:42 -0400
From: Michael McConville <mmcco@mykolab.com>
To: freebsd-net@freebsd.org
Subject: Int overflow in dhclient(1)


I sent this a few weeks ago, but it never got applied:

https://marc.info/?l=freebsd-net&m=145392057613453&w=2

Here's my explanation for the same fix in OpenBSD:

https://marc.info/?l=openbsd-tech&m=145377854103866&w=2

Thanks for your time,
Michael


Index: sbin/dhclient/dhclient.c
===================================================================
--- sbin/dhclient/dhclient.c    (revision 296886)
+++ sbin/dhclient/dhclient.c    (working copy)
@@ -138,7 +138,7 @@
 findproto(char *cp, int n)
 {
        struct sockaddr *sa;
-       int i;
+       unsigned int i;

        if (n == 0)
                return -1;
Comment 1 Michael McConville 2017-12-12 22:59:19 UTC 
Hi guys.

Just a reminder that hasn't been applied yet. It's a very simple fix.

Thanks for your time,
Michael
Comment 2 commit-hook freebsd_committer freebsd_triage 2017-12-13 20:49:18 UTC 
A commit references this bug:

Author: asomers
Date: Wed Dec 13 20:48:21 UTC 2017
New revision: 326834
URL: https://svnweb.freebsd.org/changeset/base/326834

Log:
  dhclient(8): Don't shift through the sign bit of a signed int

  PR:		208007
  Submitted by:	Michael McConville <mmcco@mykolab.com>
  MFC after:	3 weeks

Changes:
  head/sbin/dhclient/dhclient.c
Comment 3 commit-hook freebsd_committer freebsd_triage 2018-01-12 00:02:10 UTC 
A commit references this bug:

Author: asomers
Date: Fri Jan 12 00:01:10 UTC 2018
New revision: 327854
URL: https://svnweb.freebsd.org/changeset/base/327854

Log:
  MFC r326834, r326853

  r326834:
  dhclient(8): Don't shift through the sign bit of a signed int

  PR:		208007
  Submitted by:	Michael McConville <mmcco@mykolab.com>

  r326853:
  dhclient(8): raise WARNS to 3

  Mostly had to fix a lot of signed/unsigned comparison warnings

  Sponsored by:	Spectra Logic Corp

Changes:
_U  stable/11/
  stable/11/sbin/dhclient/Makefile
  stable/11/sbin/dhclient/clparse.c
  stable/11/sbin/dhclient/conflex.c
  stable/11/sbin/dhclient/dhclient.c
  stable/11/sbin/dhclient/dhcpd.h
  stable/11/sbin/dhclient/inet.c
  stable/11/sbin/dhclient/options.c
  stable/11/sbin/dhclient/packet.c
  stable/11/sbin/dhclient/parse.c
  stable/11/sbin/dhclient/privsep.c
  stable/11/sbin/dhclient/tree.c