ntp-format-security.patch

   1 diff -ur ntp-4.2.6p5/lib/isc/unix/ifiter_ioctl.c ntp-4.2.6p5.new/lib/isc/unix/ifiter_ioctl.c
   2 --- ntp-4.2.6p5/lib/isc/unix/ifiter_ioctl.c     2010-12-25 09:40:34.000000000 +0000
   3 +++ ntp-4.2.6p5.new/lib/isc/unix/ifiter_ioctl.c 2012-10-22 11:34:15.000000000 +0100
   4 @@ -159,7 +159,7 @@
   5                                 break;
   6                 }
   7                 if (iter->bufsize >= IFCONF_BUFSIZE_MAX) {
   8 -                       UNEXPECTED_ERROR(__FILE__, __LINE__,
   9 +                       UNEXPECTED_ERROR(__FILE__, __LINE__, "%s",
  10                                          isc_msgcat_get(isc_msgcat,
  11                                                         ISC_MSGSET_IFITERIOCTL,
  12                                                         ISC_MSG_BUFFERMAX,
  13 Only in ntp-4.2.6p5.new/lib/isc/unix: ifiter_ioctl.c~
  14 diff -ur ntp-4.2.6p5/ntpd/ntp_config.c ntp-4.2.6p5.new/ntpd/ntp_config.c
  15 --- ntp-4.2.6p5/ntpd/ntp_config.c       2012-10-22 11:43:38.000000000 +0100
  16 +++ ntp-4.2.6p5.new/ntpd/ntp_config.c   2012-10-22 11:38:02.000000000 +0100
  17 @@ -2334,7 +2334,7 @@
  18                 if ((RES_MSSNTP & flags) && !warned_signd) {
  19                         warned_signd = 1;
  20                         fprintf(stderr, "%s\n", signd_warning);
  21 -                       msyslog(LOG_WARNING, signd_warning);
  22 +                       msyslog(LOG_WARNING, "%s", signd_warning);
  23                 }
  24         }
  25  }
  26 Only in ntp-4.2.6p5.new/ntpd: ntp_config.c~
  27 diff -ur ntp-4.2.6p5/ntpd/ntp_control.c ntp-4.2.6p5.new/ntpd/ntp_control.c
  28 --- ntp-4.2.6p5/ntpd/ntp_control.c      2011-12-09 02:00:53.000000000 +0000
  29 +++ ntp-4.2.6p5.new/ntpd/ntp_control.c  2012-10-22 11:37:11.000000000 +0100
  30 @@ -2962,7 +2962,7 @@
  31                             " %s", str);
  32                 }
  33                 NLOG(NLOG_SYSEVENT)
  34 -                   msyslog(LOG_INFO, statstr);
  35 +                   msyslog(LOG_INFO, "%s", statstr);
  36         } else {
  37
  38                 /*
  39 @@ -2994,7 +2994,7 @@
  40                             " %s", str);
  41                 }
  42                 NLOG(NLOG_PEEREVENT)
  43 -                   msyslog(LOG_INFO, statstr);
  44 +                   msyslog(LOG_INFO, "%s", statstr);
  45         }
  46         record_proto_stats(statstr);
  47  #if DEBUG
  48 Only in ntp-4.2.6p5.new/ntpd: ntp_control.c~
  49 diff -ur ntp-4.2.6p5/ntpd/ntpd.c ntp-4.2.6p5.new/ntpd/ntpd.c
  50 --- ntp-4.2.6p5/ntpd/ntpd.c     2012-10-22 11:43:38.000000000 +0100
  51 +++ ntp-4.2.6p5.new/ntpd/ntpd.c 2012-10-22 11:39:33.000000000 +0100
  52 @@ -1242,7 +1242,7 @@
  53
  54         msyslog(LOG_ERR, "%s:%d: fatal error:", file, line);
  55         vsnprintf(errbuf, sizeof(errbuf), format, args);
  56 -       msyslog(LOG_ERR, errbuf);
  57 +       msyslog(LOG_ERR, "%s", errbuf);
  58         msyslog(LOG_ERR, "exiting (due to fatal error in library)");
  59
  60         abort();
  61 @@ -1264,7 +1264,7 @@
  62
  63         msyslog(LOG_ERR, "%s:%d: unexpected error:", file, line);
  64         vsnprintf(errbuf, sizeof(errbuf), format, args);
  65 -       msyslog(LOG_ERR, errbuf);
  66 +       msyslog(LOG_ERR, "%s", errbuf);
  67
  68         if (++unexpected_error_cnt == MAX_UNEXPECTED_ERRORS)
  69         {
  70 Only in ntp-4.2.6p5.new/ntpd: ntpd.c~