From b59207f6f2d9cbc7d733ad795d601461150f7299 Mon Sep 17 00:00:00 2001 From: Darren Carreras Date: Fri, 7 Aug 2026 09:34:05 -0400 Subject: [PATCH] ntpd: bound remote config error accumulation snprintf returns the number of bytes that would have been written, so repeated remote parser diagnostics can advance err_pos beyond err_msg and corrupt adjacent daemon state. Use the existing bounded string-buffer formatter and derive err_pos from its cursor. This is a modernized port of NTPsec commit a619d39ac2b6d3b435edd2f6f527c7cc81f78d02 by Gary E. Miller. --- ntpd/ntp_parser.c | 21 +++++++++------------ ntpd/ntp_parser.y | 21 +++++++++------------ 2 files changed, 18 insertions(+), 24 deletions(-) diff --git a/ntpd/ntp_parser.c b/ntpd/ntp_parser.c index e5ee5e10a4..53fd2dc660 100644 --- a/ntpd/ntp_parser.c +++ b/ntpd/ntp_parser.c @@ -133,6 +133,7 @@ #ifndef YYDEBUG # define YYDEBUG 1 #endif + #if YYDEBUG extern int yydebug; #endif @@ -4113,7 +4114,7 @@ yyerror( const char *msg ) { - int retval; + char *err_next; struct FILE_INFO * ip_ctx; ip_ctx = lex_current(); @@ -4122,18 +4123,15 @@ yyerror( msyslog(LOG_ERR, "line %d column %d %s", ip_ctx->errpos.nline, ip_ctx->errpos.ncol, msg); if (!lex_from_file()) { - /* Save the error message in the correct buffer */ - retval = snprintf(remote_config.err_msg + remote_config.err_pos, - sizeof remote_config.err_msg - remote_config.err_pos, - "column %d %s", - ip_ctx->errpos.ncol, msg); - - /* Increment the value of err_pos */ - if (retval > 0) - remote_config.err_pos += retval; - /* Increment the number of errors */ ++remote_config.no_errors; + + /* Append only complete messages that fit in the buffer. */ + err_next = remote_config.err_msg + remote_config.err_pos; + xsbprintf(&err_next, + remote_config.err_msg + sizeof remote_config.err_msg, + "column %d %s", ip_ctx->errpos.ncol, msg); + remote_config.err_pos = (int)(err_next - remote_config.err_msg); } } @@ -4162,4 +4160,3 @@ int main(int argc, char *argv[]) return 0; } #endif - diff --git a/ntpd/ntp_parser.y b/ntpd/ntp_parser.y index 49b55588d5..b22b501b94 100644 --- a/ntpd/ntp_parser.y +++ b/ntpd/ntp_parser.y @@ -1378,6 +1378,7 @@ misc_cmd_int_keyword #ifndef LEAP_SMEAR yyerror("Built without LEAP_SMEAR support."); #endif + } ; @@ -1837,7 +1838,7 @@ yyerror( const char *msg ) { - int retval; + char *err_next; struct FILE_INFO * ip_ctx; ip_ctx = lex_current(); @@ -1846,18 +1847,15 @@ yyerror( msyslog(LOG_ERR, "line %d column %d %s", ip_ctx->errpos.nline, ip_ctx->errpos.ncol, msg); if (!lex_from_file()) { - /* Save the error message in the correct buffer */ - retval = snprintf(remote_config.err_msg + remote_config.err_pos, - sizeof remote_config.err_msg - remote_config.err_pos, - "column %d %s", - ip_ctx->errpos.ncol, msg); - - /* Increment the value of err_pos */ - if (retval > 0) - remote_config.err_pos += retval; - /* Increment the number of errors */ ++remote_config.no_errors; + + /* Append only complete messages that fit in the buffer. */ + err_next = remote_config.err_msg + remote_config.err_pos; + xsbprintf(&err_next, + remote_config.err_msg + sizeof remote_config.err_msg, + "column %d %s", ip_ctx->errpos.ncol, msg); + remote_config.err_pos = (int)(err_next - remote_config.err_msg); } } @@ -1886,4 +1884,3 @@ int main(int argc, char *argv[]) return 0; } #endif -