Received: by mail.netbsd.org (Postfix, from userid 605) id C5DDF84D55; Tue, 11 Jul 2017 21:15:24 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 4C99384D54 for ; Tue, 11 Jul 2017 21:15:24 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id AyfDdbPFArWC for ; Tue, 11 Jul 2017 21:15:23 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.NetBSD.org [IPv6:2001:470:a085:999:28c:faff:fe03:5984]) by mail.netbsd.org (Postfix) with ESMTP id DD5B384D47 for ; Tue, 11 Jul 2017 21:15:23 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id CF841FACB; Tue, 11 Jul 2017 21:15:23 +0000 (UTC) Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" MIME-Version: 1.0 Date: Tue, 11 Jul 2017 21:15:23 +0000 From: "Soren Jacobsen" Subject: CVS commit: [netbsd-6-0] src/sbin/ping To: source-changes@NetBSD.org X-Mailer: log_accum Message-Id: <20170711211523.CF841FACB@cvs.NetBSD.org> Sender: source-changes-owner@NetBSD.org List-Id: source-changes.NetBSD.org Precedence: bulk Reply-To: source-changes-d@NetBSD.org Mail-Reply-To: "Soren Jacobsen" Mail-Followup-To: source-changes-d@NetBSD.org List-Unsubscribe: Module Name: src Committed By: snj Date: Tue Jul 11 21:15:23 UTC 2017 Modified Files: src/sbin/ping [netbsd-6-0]: ping.c Log Message: Pull up following revision(s) (requested by dholland in ticket #1424): sbin/ping/ping.c: revision 1.113 via patch PR bin/36997 Zafer Aydogan: ping doesn't validate numeric inputs enough. Check for values between INT_MAX and LONG_MAX (if they're different) when using strtol to get an int. This applies to the -c and -l options; the other uses were already checked. Also limit the inter-packet interval given with -i to values that don't cause integer overflow calling poll() with milliseconds. Really large intervals (the number is read as floating point) can produce positive poll() values but negative integers when converted to struct timespec; this produces behavior akin to using -l at first and could be construed as a local DoS vulnerability. To generate a diff of this commit: cvs rdiff -u -r1.102 -r1.102.8.1 src/sbin/ping/ping.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.