=========================================================================== [8lgm]-Advisory-26.UNIX.rdist.20-3-1996 July 1 1996: Advisory released. Jul 11 1996: Patch for Solaris 2.5 (SunOS 5.5) received for testing. The following is a trace from a Solaris 2.5 machine, using the same test as described in the advisory. ------------------------------------------------------------------- libC/Inside Shared Library Tracing. V1.0.1 (Solaris 2.5). Copyright (C) 1996, Electris Software Limited, All Rights Reserved. Tracing started Sat Jul 13 12:29:53 1996 Pid is 18999 Log file is /tmp/Inside.18999.1 Log file descriptor is 3 File descriptors open: 0, 1, 2 uid=2(bin) gid=2(bin) euid=0(root) groups=2(bin),3(sys) Program is rdist _start+0x30->atexit(call_fini) return(0) _start+0x3c->atexit(_fini) return(0) main+0x28->getuid() return(2) main+0x30->seteuid(2) return(0) main+0x58->getuid() return(2) main+0x60->getpwuid(2) return((pw_name="bin", pw_passwd="x", pw_uid=2, pw_gid=2, pw_age="",\ pw_comment="", pw_gecos="", pw_dir="/usr/bin", pw_shell="")) main+0xa4->strcpy(user, "bin") return(user) main+0xb8->strcpy(homedir, "/usr/bin") return(homedir) main+0xc8->gethostname(host, 32) return(0) (Arg 0 = "electris") main+0x104->strcmp("-d", "-Server") return(17) define+0x30->strchr("TestString", '=') return((null)) lookup+0x118->malloc(16) return(0x34030) main+0x104->strcmp("-d", "-Server") return(17) define+0x30->strchr("TestString", '=') return((null)) lookup+0x84->strcmp("TestString", "TestString") return(0) lookup+0xc8->sprintf(0xeffffb20, "%.200s redefined", "TestString") return(20) (Arg 0 = "TestString redefined") yyerror+0x1c->fflush(stdout) return(0) lookup+0xd0->fprintf(stderr, "rdist: line %d: %s\n", 1,\ "TestString redefined") return(36) main+0x43c->mktemp("/tmp/rdistXXXXXX") return("/tmp/rdista004cr") main+0x4d0->fopen("distfile", "r") return((null)) main+0x4f4->fopen("Distfile", "r") return((null)) main+0x558->perror("distfile") return() main+0x560->exit(1) ------------------------------------------------------------------- At lookup+0xc8, %s has been replaced by %.200s in the format string. This ensures that only up to 200 characters are taken from the user supplied string. ===========================================================================