Yet another buffer overflow.

2.2 candidate
(and -stable too actually, who does that?)
Reviewed by:	Warner Losh

4 files changed, 19 insertions, 9 deletions

diff --git a/sbin/restore/extern.h b/sbin/restore/extern.h
index 0f64402b33fb..c82f99795b56 100644
--- a/sbin/restore/extern.h
+++ b/sbin/restore/extern.h
@@ -36,7 +36,7 @@
 struct entry	*addentry __P((char *, ino_t, int));
 long		 addfile __P((char *, ino_t, int));
 void		 badentry __P((struct entry *, char *));
-void	 	 canon __P((char *, char *));
+void	 	 canon __P((char *, char *, int));
 void		 checkrestore __P((void));
 void		 closemt __P((void));
 void		 createfiles __P((void));
diff --git a/sbin/restore/interactive.c b/sbin/restore/interactive.c
index 1b9616cb3c25..d2158e42ecbc 100644
--- a/sbin/restore/interactive.c
+++ b/sbin/restore/interactive.c
@@ -109,7 +109,7 @@ runcmdshell()
 	arglist.glob.gl_closedir = (void *)rst_closedir;
 	arglist.glob.gl_lstat = glob_stat;
 	arglist.glob.gl_stat = glob_stat;
-	canon("/", curdir);
+	canon("/", curdir, sizeof(curdir));
 loop:
 	if (setjmp(reset) != 0) {
 		if (arglist.freeglob != 0) {
@@ -357,7 +357,7 @@ getnext:
 	 * If it is an absolute pathname, canonicalize it and return it.
 	 */
 	if (rawname[0] == '/') {
-		canon(rawname, name);
+		canon(rawname, name, sizeof(name));
 	} else {
 		/*
 		 * For relative pathnames, prepend the current directory to
@@ -366,7 +366,7 @@ getnext:
 		(void) strcpy(output, curdir);
 		(void) strcat(output, "/");
 		(void) strcat(output, rawname);
-		canon(output, name);
+		canon(output, name, sizeof(name));
 	}
 	if (glob(name, GLOB_ALTDIRFUNC, NULL, &ap->glob) < 0)
 		fprintf(stderr, "%s: out of memory\n", ap->cmd);
@@ -438,8 +438,9 @@ copynext(input, output)
  * remove any imbedded "." and ".." components.
  */
 void
-canon(rawname, canonname)
+canon(rawname, canonname, len)
 	char *rawname, *canonname;
+	int len;
 {
 	register char *cp, *np;
 
@@ -449,6 +450,11 @@ canon(rawname, canonname)
 		(void) strcpy(canonname, ".");
 	else
 		(void) strcpy(canonname, "./");
+	if (strlen(canonname) + strlen(rawname) >= len) {
+		fprintf(stderr, "canonname: not enough bufferspace\n");
+		done(1);
+	}
+		
 	(void) strcat(canonname, rawname);
 	/*
 	 * Eliminate multiple and trailing '/'s
diff --git a/sbin/restore/main.c b/sbin/restore/main.c
index a45994552353..c2c804f49f7c 100644
--- a/sbin/restore/main.c
+++ b/sbin/restore/main.c
@@ -239,7 +239,7 @@ main(argc, argv)
 		extractdirs(0);
 		initsymtable((char *)0);
 		while (argc--) {
-			canon(*argv++, name);
+			canon(*argv++, name, sizeof(name));
 			ino = dirlookup(name);
 			if (ino == 0)
 				continue;
@@ -254,7 +254,7 @@ main(argc, argv)
 		extractdirs(1);
 		initsymtable((char *)0);
 		while (argc--) {
-			canon(*argv++, name);
+			canon(*argv++, name, sizeof(name));
 			ino = dirlookup(name);
 			if (ino == 0)
 				continue;
diff --git a/sbin/restore/tape.c b/sbin/restore/tape.c
index 7aae76daa715..51a1ac52be23 100644
--- a/sbin/restore/tape.c
+++ b/sbin/restore/tape.c
@@ -63,7 +63,7 @@ static char sccsid[] = "@(#)tape.c	8.3 (Berkeley) 4/1/94";
 static long	fssize = MAXBSIZE;
 static int	mt = -1;
 static int	pipein = 0;
-static char	magtape[BUFSIZ];
+static char	*magtape;
 static int	blkcnt;
 static int	numtrec;
 static char	*tapebuf;
@@ -146,7 +146,11 @@ setinput(source)
 		pipein++;
 	}
 	setuid(getuid());	/* no longer need or want root privileges */
-	(void) strcpy(magtape, source);
+	magtape = strdup(source);
+	if (magtape == NULL) {
+		fprintf(stderr, "Cannot allocate space for magtape buffer\n");
+		done(1);
+	}
 }
 
 void