Re: user/2384: unchecked login session name can cause breakage and identity theft

[Peter Philipp <pjp@snickers.org>]

The following reply was made to PR user/2384; it has been noted by GNATS.

From: Peter Philipp <pjp@snickers.org>
To: gnats@cvs.openbsd.org, bugs@cvs.openbsd.org
Cc:  Subject: Re: user/2384: unchecked login session name can cause breakage and identity theft
Date: Sat, 9 Feb 2002 23:13:06 -0500

 On Sat, Feb 09, 2002 at 08:10:01AM -0700, Gnats wrote:
 > Thank you very much for your problem report.
 > It has the internal identification `user/2384'.
 > The individual assigned to look at your
 > bug is: bugs. 
 
 Whoops.  Here is the _real_ patch :) fcntl() was wrong in syntax.
 
 --- /usr/src/libexec/lockspool/lockspool.c	Sat Feb  9 23:10:14 2002
 +++ lockspool.c	Sat Feb  9 23:08:59 2002
 @@ -37,6 +37,7 @@
  #include <syslog.h>
  #include <unistd.h>
  #include <errno.h>
 +#include <fcntl.h>
  #include <stdio.h>
  #include "mail.local.h"
  
 @@ -52,6 +53,7 @@
  {
  	struct passwd *pw;
  	char *from, c;
 +	int flags;
  	int holdfd;
  
  	openlog(__progname, LOG_PERROR, LOG_MAIL);
 @@ -68,8 +70,6 @@
  
  	if (argc == 2)
  		from = argv[1];
 -	else
 -		from = getlogin();
  
  	if (from) {
  		pw = getpwnam(from);
 @@ -90,8 +90,29 @@
  	}
  	write(STDOUT_FILENO, "1\n", 2);
  
 -	while (read(0, &c, 1) == -1 && errno == EINTR)
 -		;
 +	/* make sure STDIN is blocking */
 +	if ((flags = fcntl(STDIN_FILENO, F_GETFL, 0)) < 0) {
 +		/* XXX */
 +		exit(1);
 +	}
 +	if (flags & O_NONBLOCK) {
 +		/*
 +		 * spinning around read() is costly so we sleep for a sec
 +		 */
 +		while (read(STDIN_FILENO, &c, 1) == -1) {
 +			if (errno == EWOULDBLOCK) 
 +				sleep(1);
 +			else if (errno == EINTR) 
 +				continue;
 +			else
 +				break;
 +		}
 +	} else {
 +		/* read blocks until EOF or error */
 +		while (read(STDIN_FILENO, &c, 1) == -1 && errno == EINTR)
 +			;
 +	}
 +
  	rellock();
  	exit (0);
  }
 
 -- 
 "Stand on my shoulders, not on my toes." - James da Silva <jds@cs.umd.edu>