From owner-ports-jp@jp.freebsd.org  Fri Mar 10 00:56:11 2000
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id AAA55036;
	Fri, 10 Mar 2000 00:56:11 +0900 (JST)
	(envelope-from owner-ports-jp@jp.FreeBSD.org)
Received: from serio.al.rim.or.jp (serio.al.rim.or.jp [202.247.191.123])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id AAA55031
	for <ports-jp@jp.freebsd.org>; Fri, 10 Mar 2000 00:56:11 +0900 (JST)
	(envelope-from kuriyama@jp.FreeBSD.org)
Received: from mail1.rim.or.jp
	by serio.al.rim.or.jp (8.9.3/3.7W/HMX-12) id AAA23050
	for <ports-jp@jp.freebsd.org>; Fri, 10 Mar 2000 00:56:01 +0900 (JST)
Received: from rhea.sky.rim.or.jp (pppa69.st.rim.or.jp [202.247.162.69]) by mail1.rim.or.jp (3.7W)
	id AAA19545 for <ports-jp@jp.freebsd.org>; Fri, 10 Mar 2000 00:55:57 +0900 (JST)
Received: from localhost.sky.rim.or.jp (localhost [127.0.0.1])
	by rhea.sky.rim.or.jp (8.9.3/3.7W/rhea-1.2) with ESMTP id AAA94133
	for <ports-jp@jp.freebsd.org>; Fri, 10 Mar 2000 00:55:55 +0900 (JST)
Date: Fri, 10 Mar 2000 00:55:54 +0900
Message-ID: <86k8jcxhmd.wl@localhost.sky.rim.or.jp>
From: Jun Kuriyama <kuriyama@jp.freebsd.org>
To: ports-jp@jp.freebsd.org
In-Reply-To: In your message of "Thu, 09 Mar 2000 19:03:33 +0900"
	<20000309190333N.taoka@infonets.hiroshima-u.ac.jp>
References: <86vh2yo0qu.wl@cheerful.com>
	<57633.952527814@ideon.st.ryukoku.ac.jp>
	<86r9dky3lu.wl@localhost.sky.rim.or.jp>
	<20000309190333N.taoka@infonets.hiroshima-u.ac.jp>
User-Agent: Wanderlust/2.2.16 (No Son Of Mine) SEMI/1.13.7 (Awazu) FLIM/1.13.2 (Kasanui) MULE XEmacs/21.1 (patch 8) (Bryce Canyon) (i386--freebsd)
MIME-Version: 1.0 (generated by SEMI 1.13.7 - "Awazu")
Content-Type: text/plain; charset=ISO-2022-JP
Reply-To: ports-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+990727
X-Sequence: ports-jp 9070
Subject: [ports-jp 9070] Re: uum/canuum/jserver
Errors-To: owner-ports-jp@jp.freebsd.org
Sender: owner-ports-jp@jp.freebsd.org
X-Originator: kuriyama@jp.freebsd.org

From: TAOKA Satoshi <taoka@infonets.hiroshima-u.ac.jp>
> $B$^$?(B3.2-RELEASE$B$G$b!";n$7$^$7$?$,!"$H$j$"$($:$A$c$s$HF0$$$F$$$k$h$&$G$9!#(B
> $B$I$&$>(Bcommit$B$7$F$/$@$5$$!#(B

$B!!$7$/$7$/!D!D!#(BWnn-4.2 $B$J$s$+7y$$$@!<!#0J2<$KBP=h$9$k$?$a$NJQ99$G$9!#$^(B
$B$@<+J,$,$5$C$-(B commit $B$7$?J,$,<j85$N%j%]%8%H%j$K$J$$$N$G!"$=$l0JA0$+$i$N(B
$B:9J,$G$9!#(B
$B!!AjJQ$o$i$:$J$<$+(B make configure $B$G(B fail $B$7$F$7$^$&$N$G!"C/$+(B make $B$G$-(B
$B$k$+3NG'$*4j$$$7$^$9!#$A$g$C$HL@F|$OF0$/;~4V$,<h$l$k$+$I$&$+2x$7$$$N$G!"(B
$B$h$1$l$PED2,$5$s(B commit $B$7$A$c$C$F$/$@$5$$!#(B

# $B$C$D!<$+(B make $B$b$;$:$K:9J,$@$9$J$h!#!d$/$j$d$^(B

> SPS Advisory #34
> "Wnn4.2/FreeWnn1.10/FreeWnn1.1.1a016-jserver remote overflow exploit"


Index: patches/patch-ab
===================================================================
RCS file: /home/ncvs/ports/japanese/Wnn/patches/patch-ab,v
retrieving revision 1.4
diff -u -r1.4 patch-ab
--- patch-ab	1997/09/10 06:51:54	1.4
+++ patch-ab	2000/03/09 15:49:47
@@ -1,5 +1,5 @@
---- ./Wnn/jserver/de.c.orig	Fri Aug 19 10:31:23 1994
-+++ ./Wnn/jserver/de.c	Fri Aug  1 18:54:55 1997
+--- Wnn/jserver/de.c~	Fri Aug 19 10:31:23 1994
++++ Wnn/jserver/de.c	Fri Mar 10 00:44:42 2000
 @@ -65,6 +65,9 @@
  
  #include <sys/ioctl.h>
@@ -27,3 +27,38 @@
  	}
  
  #if defined(hpux) || defined(SOLARIS)
+@@ -542,10 +554,14 @@
+ 
+ /**	**/
+ void
+-gets_cur(cp)
++gets_cur(cp, len)
+ register char *cp;
++int len;
+ {
+-    while((*cp++ = getc_cur()) != '\0');
++    int i;
++
++    for (i = 0; i < len; i++)
++	if ((*(cp + i) = getc_cur()) == '\0') break;
+ }
+ 
+ /**	**/
+@@ -648,6 +664,17 @@
+ {
+     register int c;
+     while(c= *p++) putc_cur(c);
++    putc_cur(0);
++}
++
++/**	**/
++void
++puts_n_cur(p,n)
++char *p;
++int n;
++{
++    register int c;
++    while((c = *p++) && --n >= 0) putc_cur(c);
+     putc_cur(0);
+ }
+ 
Index: patches/patch-ak
===================================================================
RCS file: /home/ncvs/ports/japanese/Wnn/patches/patch-ak,v
retrieving revision 1.1
diff -u -r1.1 patch-ak
--- patch-ak	1997/09/10 06:51:56	1.1
+++ patch-ak	2000/03/09 15:49:47
@@ -1,5 +1,5 @@
---- ../Xsi.orig/Wnn/uum/jhlp.c	Fri Aug 19 10:32:12 1994
-+++ ./Wnn/uum/jhlp.c	Fri Aug  1 18:54:18 1997
+--- Wnn/uum/jhlp.c.orig	Thu Mar  9 16:34:56 2000
++++ Wnn/uum/jhlp.c	Thu Mar  9 16:44:26 2000
 @@ -80,6 +80,9 @@
  
  jmp_buf kk_env;
@@ -10,8 +10,37 @@
  #ifdef SYSVR2
  #	include <sys/param.h>
  #endif /* SYSVR2 */
-@@ -263,9 +266,11 @@
+@@ -168,12 +171,14 @@
  
+     strcpy(username, getpwuid(getuid())->pw_name);
+     if((name = getenv(WNN_USERNAME_ENV)) != NULL){
+-	strcpy(username, name);
++	strncpy(username, name, PATHNAMELEN - 1);
++	username[PATHNAMELEN - 1] = '\0';
+     }
+     for (i = 1; i < argc;) {
+ 	if (!strcmp(argv[i++], "-L")) {
+ 	    if (i >= argc || argv[i][0] == '-') default_usage();
+-	    strcpy(lang_dir, argv[i++]);
++	    strncpy(lang_dir, argv[i++], 31);
++	    lang_dir[31] = '\0';
+ 	    for (;i < argc; i++) {
+ 		argv[i - 2] = argv[i];
+ 	    }
+@@ -233,8 +238,9 @@
+ 	    server_env = WNN_DEF_SERVER_ENV;
+ 	}
+ 	if(name = getenv(server_env)) {
+-	    strcpy(def_servername, name);
+-	    strcpy(def_reverse_servername, name);
++	    strncpy(def_servername, name, PATHNAMELEN - 1);
++	    def_servername[PATHNAMELEN - 1] = '\0';
++	    strcpy(def_reverse_servername, def_servername);
+ 	}
+     }
+ 
+@@ -263,9 +269,11 @@
+ 
  
  #if defined(BSD42) && !defined(DGUX)
 +#if !(defined(BSD) && (BSD >= 199306))
@@ -21,8 +50,60 @@
 +#endif
  #endif /* BSD42 */
  
+ 
+@@ -492,7 +500,8 @@
+ 
+ static int do_k_opt()
+ {
+-    strcpy(uumkey_name_in_uumrc, optarg);
++    strncpy(uumkey_name_in_uumrc, optarg, PATHNAMELEN - 1);
++    uumkey_name_in_uumrc[PATHNAMELEN - 1] = '\0';
+     if (*uumkey_name_in_uumrc == '\0') {
+ 	return -1;
+     }
+@@ -502,7 +511,8 @@
+ 
+ static int do_c_opt()
+ {
+-    strcpy(convkey_name_in_uumrc, optarg);
++    strncpy(convkey_name_in_uumrc, optarg, PATHNAMELEN - 1);
++    convkey_name_in_uumrc[PATHNAMELEN - 1] = '\0';
+     if (*convkey_name_in_uumrc == '\0') {
+ 	return -1;
+     }
+@@ -512,7 +522,8 @@
+ 
+ static int do_r_opt()
+ {
+-    strcpy(rkfile_name_in_uumrc, optarg);
++    strncpy(rkfile_name_in_uumrc, optarg, PATHNAMELEN - 1);
++    rkfile_name_in_uumrc[PATHNAMELEN - 1] = '\0';
+     if (*rkfile_name_in_uumrc == '\0') {
+ 	return -1;
+     }
+@@ -528,8 +539,9 @@
  
-@@ -771,7 +776,12 @@
+ static int do_D_opt()
+ {
+-    strcpy(def_servername, optarg);
+-    strcpy(def_reverse_servername, optarg);
++    strncpy(def_servername, optarg, PATHNAMELEN - 1);
++    def_servername[PATHNAMELEN - 1] = '\0';
++    strcpy(def_reverse_servername, def_servername);
+     if (*def_servername == '\0') {
+ 	return -1;
+     }
+@@ -538,7 +550,8 @@
+ 
+ static int do_n_opt()
+ {
+-    strcpy(username, optarg);
++    strncpy(username, optarg, PATHNAMELEN - 1);
++    username[PATHNAMELEN - 1] = '\0';
+     if (*username == '\0') {
+ 	return -1;
+     }
+@@ -771,7 +784,12 @@
  #endif
      int pid;
  
@@ -36,7 +117,7 @@
  	if (WIFSTOPPED(status)) {
  #ifdef SIGCONT
  	    kill(pid, SIGCONT);
-@@ -1140,9 +1150,11 @@
+@@ -1140,9 +1158,11 @@
  	setpgrp(0, pid);
  #endif /* BSD42 */
  
@@ -48,7 +129,7 @@
  
  #ifdef linux
  	setsid();
-@@ -1562,9 +1574,11 @@
+@@ -1562,9 +1582,11 @@
  	perror(prog);
      }
  
@@ -60,7 +141,7 @@
  #ifdef TIOCSSIZE
      pty_rowcol.ts_lines = 0;
      pty_rowcol.ts_cols = 0;
-@@ -1636,7 +1650,16 @@
+@@ -1636,7 +1658,16 @@
  char *b, *pty;
  int no;
  {
Index: patches/patch-bl
===================================================================
RCS file: /home/ncvs/ports/japanese/Wnn/patches/patch-bl,v
retrieving revision 1.1
diff -u -r1.1 patch-bl
--- patch-bl	1999/02/10 14:32:00	1.1
+++ patch-bl	2000/03/09 15:49:47
@@ -25,23 +25,3 @@
      put4_cur(jtl->syurui);
      put4_cur(jtl->gosuu);
      put4_cur(files[fid].localf);
---- Wnn/jserver/de.c.98-10-12	Mon Oct 12 01:01:28 1998
-+++ Wnn/jserver/de.c	Sun Jan 24 14:50:14 1999
-@@ -665,6 +665,17 @@
- 
- /**	**/
- void
-+puts_n_cur(p,n)
-+char *p;
-+int n;
-+{
-+    register int c;
-+    while((c = *p++) && --n >= 0) putc_cur(c);
-+    putc_cur(0);
-+}
-+
-+/**	**/
-+void
- putws_cur(p)
- w_char *p;
- {
Index: patches/patch-cd
===================================================================
RCS file: patch-cd
diff -N patch-cd
--- /dev/null	Thu Mar  9 22:35:59 2000
+++ patch-cd	Fri Mar 10 00:49:47 2000
@@ -0,0 +1,14 @@
+--- Wnn/jlib/js.c~	Thu Mar  9 16:34:55 2000
++++ Wnn/jlib/js.c	Thu Mar  9 16:49:51 2000
+@@ -325,7 +325,10 @@
+ char *pserver;
+ {
+     register char *p;
+-    strcpy(pserver, server);
++    /* Workaround for pserver buffer overrun : Nov 11,1999 by T.Aono */
++    /* assumes pserver[64]. variable length string is not supported. */
++    strncpy(pserver, server, 64 - 1);
++    pserver[64 - 1] = '\0';
+     p = pserver;
+     for( ; *p && *p != ':'; p++) ;
+     if (!*p) return(0);	/* does not have a colon */
Index: patches/patch-ce
===================================================================
RCS file: patch-ce
diff -N patch-ce
--- /dev/null	Thu Mar  9 22:35:59 2000
+++ patch-ce	Fri Mar 10 00:49:47 2000
@@ -0,0 +1,33 @@
+--- Wnn/jserver/do_env.c~	Wed Apr 28 09:25:54 1993
++++ Wnn/jserver/do_env.c	Fri Mar 10 00:25:57 2000
+@@ -79,10 +79,10 @@
+  char tmp_buf[256];
+ 
+  	version = get4_cur();
+-	gets_cur(tmp_buf);
++	gets_cur(tmp_buf, 256);
+ 	tmp_buf[WNN_HOSTLEN-1] = '\0'; /* truncate by WNN_HOSTLEN */
+ 	strcpy(c_c->host_name, tmp_buf);
+-	gets_cur(tmp_buf);
++	gets_cur(tmp_buf, 256);
+ 	tmp_buf[WNN_ENVNAME_LEN-1] = '\0'; /* truncate by WNN_ENVNAME_LEN */
+ 	strcpy(c_c->user_name, tmp_buf);
+ 	error1("Inet user=%s@%s\n",c_c -> user_name,c_c->host_name);
+@@ -125,7 +125,7 @@
+ js_connect()
+ {char n[256];
+  register int x;
+- gets_cur(n);
++ gets_cur(n, 256);
+  x=conn1(n);
+  if(x==-1){error_ret(); return;}
+  put4_cur(x);
+@@ -184,7 +184,7 @@
+ {
+     char n[256];
+ 
+-    gets_cur(n);
++    gets_cur(n, 256);
+     if(find_env_by_name(n) != -1){ /* exist */
+ 	put4_cur(1);
+     }else{
Index: patches/patch-cf
===================================================================
RCS file: patch-cf
diff -N patch-cf
--- /dev/null	Thu Mar  9 22:35:59 2000
+++ patch-cf	Fri Mar 10 00:49:47 2000
@@ -0,0 +1,13 @@
+--- Wnn/jserver/do_dic_env.c~	Wed Sep 30 14:25:06 1992
++++ Wnn/jserver/do_dic_env.c	Fri Mar 10 00:25:25 2000
+@@ -78,8 +78,8 @@
+     nice=get4_cur();
+     rw=get4_cur();
+     hrw=get4_cur();
+-    gets_cur(pw);
+-    gets_cur(pw1);
++    gets_cur(pw, WNN_PASSWD_LEN);
++    gets_cur(pw1, WNN_PASSWD_LEN);
+     rev=get4_cur();		/* rev is to add it as reverse dict */
+     
+     error1("dic_add: eid=%d,fid=%d,hfid=%d",eid,fid,hfid);
Index: patches/patch-cg
===================================================================
RCS file: patch-cg
diff -N patch-cg
--- /dev/null	Thu Mar  9 22:35:59 2000
+++ patch-cg	Fri Mar 10 00:49:47 2000
@@ -0,0 +1,16 @@
+--- Wnn/jserver/dispatch.c~	Tue Sep 22 13:49:00 1992
++++ Wnn/jserver/dispatch.c	Fri Mar 10 00:24:44 2000
+@@ -308,9 +308,11 @@
+  */
+ 
+ void
+-get_file_name(p) register char *p;
++get_file_name(p, len)
++register char *p;
++int len;
+ {
+- gets_cur(p);
++ gets_cur(p, len);
+  if(p[0] == 0){
+      return;
+  }
Index: patches/patch-ch
===================================================================
RCS file: patch-ch
diff -N patch-ch
--- /dev/null	Thu Mar  9 22:35:59 2000
+++ patch-ch	Fri Mar 10 00:49:47 2000
@@ -0,0 +1,122 @@
+--- Wnn/jserver/do_filecom.c~	Thu May 27 13:42:53 1993
++++ Wnn/jserver/do_filecom.c	Fri Mar 10 00:29:09 2000
+@@ -92,7 +92,7 @@
+ {char path[FILENAME]; int x;
+  int err = 0;
+  err = envhandle();
+- get_file_name(path);
++ get_file_name(path, FILENAME);
+ 
+  if(err == -1){ error_ret(); return;}
+  x=mkdir(path , MODE );
+@@ -117,7 +117,7 @@
+  int eid;
+ 
+  eid = envhandle();
+- get_file_name(path);
++ get_file_name(path, FILENAME);
+  if(eid == -1) {error_ret(); return;}
+      
+  if((fd = open(path , O_RDONLY)) >= 0){
+@@ -142,7 +142,7 @@
+  int amode;
+  envhandle();
+  amode=get4_cur();
+- get_file_name(path);
++ get_file_name(path, FILENAME);
+ 
+ #ifdef WRITE_CHECK
+  check_backup(path);
+@@ -222,7 +222,7 @@
+  char n[FILENAME];
+ 
+  get4_cur();	/* env_id */
+- get_file_name(n);
++ get_file_name(n, FILENAME);
+ 
+  put4_cur(file_stat(n));
+  putc_purge();
+@@ -349,9 +349,9 @@
+ 
+  env_id=get4_cur();	/* env_id */
+  fid=get4_cur();
+- get_file_name(fn);
++ get_file_name(fn, FILE_NAME_L);
+  getws_cur(com);
+- gets_cur(hpasswd);
++ gets_cur(hpasswd, WNN_PASSWD_LEN);
+  if(find_fid_in_env(env_id,fid)==-1){ /* valid */
+      wnn_errorno=WNN_FID_ERROR;
+      error_ret(); putc_purge(); return;
+@@ -410,10 +410,10 @@
+     w_char com[1024];
+     char passwd[WNN_PASSWD_LEN], hpasswd[WNN_PASSWD_LEN];
+     get4_cur();	/* env_id */
+-    get_file_name(fn);
++    get_file_name(fn, FILE_NAME_L);
+     getws_cur(com);
+-    gets_cur(passwd);
+-    gets_cur(hpasswd);
++    gets_cur(passwd, WNN_PASSWD_LEN);
++    gets_cur(hpasswd, WNN_PASSWD_LEN);
+     type = get4_cur();
+ 
+     if(type != WNN_REV_DICT && 
+@@ -546,7 +546,7 @@
+  int x;
+ 
+ /*  get4_cur();	env_id */
+- get_file_name(n);
++ get_file_name(n, FILE_NAME_L);
+ 
+  if((x=file_loaded(n)) < 0) put4_cur(-1);
+  else put4_cur(x);
+@@ -650,7 +650,7 @@
+ 
+  put4_cur(1); putc_purge();
+ 
+- gets_cur(n);
++ gets_cur(n, FILE_NAME_L);
+ 
+  /*	read file	*/
+  files[fid].localf= REMOTE;
+@@ -674,7 +674,7 @@
+  int env_id,fid;
+ 
+  env_id=get4_cur();	/* env_id */
+- get_file_name(n);
++ get_file_name(n, FILE_NAME_L);
+ 
+  fid = file_loaded(n);
+  if(fid == -1){
+@@ -742,7 +742,7 @@
+  char n[FILE_NAME_L];
+  env_id=get4_cur();	/* env_id */
+  fid=get4_cur();
+- get_file_name(n);
++ get_file_name(n, FILE_NAME_L);
+ 
+  if(find_fid_in_env(env_id,fid)==-1){ /* valid */
+ 	wnn_errorno=WNN_FID_ERROR;
+@@ -895,8 +895,8 @@
+     char passwd[WNN_PASSWD_LEN];
+     int x;
+     
+-    get_file_name(n);
+-    gets_cur(passwd);
++    get_file_name(n, FILE_NAME_L);
++    gets_cur(passwd, WNN_PASSWD_LEN);
+     
+     x = file_remove(n, passwd);
+     if(x == -1){
+@@ -958,8 +958,8 @@
+     envi = get4_cur();	/* env_id */
+     fid = get4_cur();
+     which = get4_cur();
+-    gets_cur(old);
+-    gets_cur(new);
++    gets_cur(old, WNN_PASSWD_LEN);
++    gets_cur(new, WNN_PASSWD_LEN);
+ 
+     if(find_fid_in_env(envi,fid) == -1){
+ 	wnn_errorno=WNN_FID_ERROR;


-- 
Jun Kuriyama <kuriyama@jp.FreeBSD.org> / FreeBSD Project
