Update to FreeBSD head 2017-06-01

Git mirror commit dfb26efac4ce9101dda240e94d9ab53f80a9e131.

Update #3472.

3 files changed, 32 insertions, 24 deletions

diff --git a/freebsd/sbin/dhclient/dhclient.c b/freebsd/sbin/dhclient/dhclient.c
index 56d7cbf7..b36fce4d 100644
--- a/freebsd/sbin/dhclient/dhclient.c
+++ b/freebsd/sbin/dhclient/dhclient.c
@@ -110,7 +110,11 @@ struct pidfh *pidfile;
  */
 #define ASSERT_STATE(state_is, state_shouldbe) {}
 
-#define TIME_MAX 2147483647
+/*
+ * We need to check that the expiry, renewal and rebind times are not beyond
+ * the end of time (~2038 when a 32-bit time_t is being used).
+ */
+#define TIME_MAX        ((((time_t) 1 << (sizeof(time_t) * CHAR_BIT - 2)) - 1) * 2 + 1)
 
 int		log_priority;
 int		no_daemon;
@@ -768,15 +772,17 @@ dhcpack(struct packet *packet)
 	else
 		ip->client->new->expiry = default_lease_time;
 	/* A number that looks negative here is really just very large,
-	   because the lease expiry offset is unsigned. */
-	if (ip->client->new->expiry < 0)
-		ip->client->new->expiry = TIME_MAX;
+	   because the lease expiry offset is unsigned. Also make sure that
+           the addition of cur_time below does not overflow (a 32 bit) time_t. */
+	if (ip->client->new->expiry < 0 ||
+            ip->client->new->expiry > TIME_MAX - cur_time)
+		ip->client->new->expiry = TIME_MAX - cur_time;
 	/* XXX should be fixed by resetting the client state */
 	if (ip->client->new->expiry < 60)
 		ip->client->new->expiry = 60;
 
         /* Unless overridden in the config, take the server-provided renewal
-         * time if there is one; otherwise figure it out according to the spec.
+         * time if there is one. Otherwise figure it out according to the spec.
          * Also make sure the renewal time does not exceed the expiry time.
          */
         if (ip->client->config->default_actions[DHO_DHCP_RENEWAL_TIME] ==
@@ -788,7 +794,8 @@ dhcpack(struct packet *packet)
 		    ip->client->new->options[DHO_DHCP_RENEWAL_TIME].data);
 	else
 		ip->client->new->renewal = ip->client->new->expiry / 2;
-        if (ip->client->new->renewal > ip->client->new->expiry / 2)
+        if (ip->client->new->renewal < 0 ||
+            ip->client->new->renewal > ip->client->new->expiry / 2)
                 ip->client->new->renewal = ip->client->new->expiry / 2;
 
 	/* Same deal with the rebind time. */
@@ -800,20 +807,15 @@ dhcpack(struct packet *packet)
 		ip->client->new->rebind = getULong(
 		    ip->client->new->options[DHO_DHCP_REBINDING_TIME].data);
 	else
-		ip->client->new->rebind = ip->client->new->renewal * 7 / 4;
-        if (ip->client->new->rebind > ip->client->new->renewal * 7 / 4)
-                ip->client->new->rebind = ip->client->new->renewal * 7 / 4;
-
-	ip->client->new->expiry += cur_time;
-	/* Lease lengths can never be negative. */
-	if (ip->client->new->expiry < cur_time)
-		ip->client->new->expiry = TIME_MAX;
-	ip->client->new->renewal += cur_time;
-	if (ip->client->new->renewal < cur_time)
-		ip->client->new->renewal = TIME_MAX;
-	ip->client->new->rebind += cur_time;
-	if (ip->client->new->rebind < cur_time)
-		ip->client->new->rebind = TIME_MAX;
+		ip->client->new->rebind = ip->client->new->renewal / 4 * 7;
+	if (ip->client->new->rebind < 0 ||
+            ip->client->new->rebind > ip->client->new->renewal / 4 * 7)
+                ip->client->new->rebind = ip->client->new->renewal / 4 * 7;
+
+        /* Convert the time offsets into seconds-since-the-epoch */
+        ip->client->new->expiry += cur_time;
+        ip->client->new->renewal += cur_time;
+        ip->client->new->rebind += cur_time;
 
 	bind_lease(ip);
 }
diff --git a/freebsd/sbin/dhclient/options.c b/freebsd/sbin/dhclient/options.c
index 5ea8de7c..8dac0039 100644
--- a/freebsd/sbin/dhclient/options.c
+++ b/freebsd/sbin/dhclient/options.c
@@ -785,7 +785,7 @@ pretty_print_option(unsigned int code, unsigned char *data, int len,
 				dp += 4;
 				break;
 			case 'L':
-				opcount = snprintf(op, opleft, "%ld",
+				opcount = snprintf(op, opleft, "%lu",
 				    (unsigned long)getULong(dp));
 				if (opcount >= opleft || opcount == -1)
 					goto toobig;
@@ -801,7 +801,7 @@ pretty_print_option(unsigned int code, unsigned char *data, int len,
 				dp += 2;
 				break;
 			case 'S':
-				opcount = snprintf(op, opleft, "%d",
+				opcount = snprintf(op, opleft, "%u",
 				    getUShort(dp));
 				if (opcount >= opleft || opcount == -1)
 					goto toobig;
diff --git a/freebsd/sbin/dhclient/parse.c b/freebsd/sbin/dhclient/parse.c
index 19d407ea..88853312 100644
--- a/freebsd/sbin/dhclient/parse.c
+++ b/freebsd/sbin/dhclient/parse.c
@@ -133,8 +133,10 @@ parse_string(FILE *cfile)
 		error("no memory for string %s.", val);
 	memcpy(s, val, valsize);
 
-	if (!parse_semi(cfile))
+	if (!parse_semi(cfile)) {
+		free(s);
 		return (NULL);
+	}
 	return (s);
 }
 
@@ -248,9 +250,10 @@ parse_numeric_aggregate(FILE *cfile, unsigned char *buf, int *max,
 	char *val, *t;
 	size_t valsize;
 	pair c = NULL;
+	unsigned char *lbufp = NULL;
 
 	if (!bufp && *max) {
-		bufp = malloc(*max * size / 8);
+		lbufp = bufp = malloc(*max * size / 8);
 		if (!bufp)
 			error("can't allocate space for numeric aggregate");
 	} else
@@ -267,6 +270,7 @@ parse_numeric_aggregate(FILE *cfile, unsigned char *buf, int *max,
 				parse_warn("too few numbers.");
 				if (token != SEMI)
 					skip_to_semi(cfile);
+				free(lbufp);
 				return (NULL);
 			}
 			token = next_token(&val, cfile);
@@ -283,6 +287,7 @@ parse_numeric_aggregate(FILE *cfile, unsigned char *buf, int *max,
 		    (base != 16 || token != NUMBER_OR_NAME)) {
 			parse_warn("expecting numeric value.");
 			skip_to_semi(cfile);
+			free(lbufp);
 			return (NULL);
 		}
 		/*
@@ -304,6 +309,7 @@ parse_numeric_aggregate(FILE *cfile, unsigned char *buf, int *max,
 
 	/* If we had to cons up a list, convert it now. */
 	if (c) {
+		free(lbufp);
 		bufp = malloc(count * size / 8);
 		if (!bufp)
 			error("can't allocate space for numeric aggregate.");