The recently issued patch for security issue FreeBSD-SA-16:36.libc has three problems affecting the link_ntoa() function. 1. Hex digits are reversed in order: 0x27 is represented as 72, etc. This is because the old code wrote out[1] then out[0]; the new code writes *out++ and *out++ in the same order. 2. Accounting of buffer space is bad: In the single-digit case, it has 'rem++' but should probably have 'rem--' instead. 3. Bytes in the range 0x80-0xff are represented badly, for instance 0x84 is represented by backslash in my test environment. This appears to result from 'char' and 'int' being signed, in the 'if (i > 0xf)'. This one might also depend on my very unusual system.
Created attachment 177740 [details] proposed patch, not tested yet
Regarding the attached proposed patch, if i is negative, (i >> 4) will be negative too, and a negative offset into hexlist[] is not good. Suggest ((i >> 4) & 0xf).
Created attachment 177744 [details] proposed patch #2, somewhat tested
For what it's worth, I've tested your "proposed patch #2, somewhat tested" fix on my system, and it passed the tests.
Thanks for confirmation. I've launched freebsd-update builds yesterday with patch #2 and they are still running. Once they are done, I will publish revised advisory.
A commit references this bug: Author: glebius Date: Wed Dec 7 23:18:00 UTC 2016 New revision: 309688 URL: https://svnweb.freebsd.org/changeset/base/309688 Log: Address regressions in SA-16:37.libc. PR: 215105 Submitted by: <jtd2004a sbcglobal.net> Changes: head/lib/libc/net/linkaddr.c
A commit references this bug: Author: glebius Date: Wed Dec 7 23:19:46 UTC 2016 New revision: 309689 URL: https://svnweb.freebsd.org/changeset/base/309689 Log: Merge rr309688: address regressions in SA-16:37.libc. PR: 215105 Submitted by: <jtd2004a sbcglobal.net> Changes: _U stable/11/ stable/11/lib/libc/net/linkaddr.c
A commit references this bug: Author: glebius Date: Wed Dec 7 23:20:27 UTC 2016 New revision: 309690 URL: https://svnweb.freebsd.org/changeset/base/309690 Log: Merge rr309688: address regressions in SA-16:37.libc. PR: 215105 Submitted by: <jtd2004a sbcglobal.net> Changes: _U stable/10/ stable/10/lib/libc/net/linkaddr.c
A commit references this bug: Author: glebius Date: Wed Dec 7 23:20:51 UTC 2016 New revision: 309691 URL: https://svnweb.freebsd.org/changeset/base/309691 Log: Merge rr309688: address regressions in SA-16:37.libc. PR: 215105 Submitted by: <jtd2004a sbcglobal.net> Changes: _U stable/9/ _U stable/9/lib/ _U stable/9/lib/libc/ stable/9/lib/libc/net/linkaddr.c
A commit references this bug: Author: glebius Date: Wed Dec 7 23:29:43 UTC 2016 New revision: 309692 URL: https://svnweb.freebsd.org/changeset/base/309692 Log: Merge r309688: address regressions in SA-16:37.libc. PR: 215105 Submitted by: <jtd2004a sbcglobal.net> Approved by: so Changes: _U releng/11.0/ releng/11.0/UPDATING releng/11.0/lib/libc/net/linkaddr.c releng/11.0/sys/conf/newvers.sh
A commit references this bug: Author: glebius Date: Wed Dec 7 23:31:07 UTC 2016 New revision: 309693 URL: https://svnweb.freebsd.org/changeset/base/309693 Log: Merge r309688: address regressions in SA-16:37.libc. PR: 215105 Submitted by: <jtd2004a sbcglobal.net> Approved by: so Changes: _U releng/10.3/ releng/10.3/UPDATING releng/10.3/lib/libc/net/linkaddr.c releng/10.3/sys/conf/newvers.sh
A commit references this bug: Author: glebius Date: Wed Dec 7 23:32:42 UTC 2016 New revision: 309694 URL: https://svnweb.freebsd.org/changeset/base/309694 Log: Merge r309688: address regressions in SA-16:37.libc. PR: 215105 Submitted by: <jtd2004a sbcglobal.net> Approved by: so Changes: _U releng/10.2/ releng/10.2/UPDATING releng/10.2/lib/libc/net/linkaddr.c releng/10.2/sys/conf/newvers.sh
A commit references this bug: Author: glebius Date: Wed Dec 7 23:34:07 UTC 2016 New revision: 309696 URL: https://svnweb.freebsd.org/changeset/base/309696 Log: Merge r309688: address regressions in SA-16:37.libc. PR: 215105 Submitted by: <jtd2004a sbcglobal.net> Approved by: so Changes: _U releng/10.1/ releng/10.1/UPDATING releng/10.1/lib/libc/net/linkaddr.c releng/10.1/sys/conf/newvers.sh
A commit references this bug: Author: glebius Date: Wed Dec 7 23:35:16 UTC 2016 New revision: 309697 URL: https://svnweb.freebsd.org/changeset/base/309697 Log: Merge r309688: address regressions in SA-16:37.libc. PR: 215105 Submitted by: <jtd2004a sbcglobal.net> Approved by: so Changes: _U releng/9.3/ releng/9.3/UPDATING _U releng/9.3/lib/libc/ releng/9.3/lib/libc/net/linkaddr.c releng/9.3/sys/conf/newvers.sh