aboutsummaryrefslogtreecommitdiffstats
path: root/ntpd/refclock_mx4200.c
diff options
context:
space:
mode:
authorXin LI <delphij@FreeBSD.org>2017-03-23 05:19:00 +0000
committerXin LI <delphij@FreeBSD.org>2017-03-23 05:19:00 +0000
commit07ac48c3644021279e113d530764a231e27490a7 (patch)
tree0cbc5ca54b66605faf74bfd0773111623cfe3d9b /ntpd/refclock_mx4200.c
parent01b922f62c559f5778a983c365d390371956a214 (diff)
downloadsrc-07ac48c3644021279e113d530764a231e27490a7.tar.gz
src-07ac48c3644021279e113d530764a231e27490a7.zip
Vendor import of ntp-4.2.8p10.vendor/ntp/4.2.8p10
Notes
Notes: svn path=/vendor/ntp/dist/; revision=315791 svn path=/vendor/ntp/4.2.8p10/; revision=315792; tag=vendor/ntp/4.2.8p10
Diffstat (limited to 'ntpd/refclock_mx4200.c')
-rw-r--r--ntpd/refclock_mx4200.c32
1 files changed, 20 insertions, 12 deletions
diff --git a/ntpd/refclock_mx4200.c b/ntpd/refclock_mx4200.c
index c9422290d39a..6969e6a2deb1 100644
--- a/ntpd/refclock_mx4200.c
+++ b/ntpd/refclock_mx4200.c
@@ -1596,34 +1596,42 @@ mx4200_send(peer, fmt, va_alist)
struct refclockproc *pp;
struct mx4200unit *up;
- register char *cp;
+ register char *cp, *ep;
register int n, m;
va_list ap;
char buf[1024];
u_char ck;
+ pp = peer->procptr;
+ up = pp->unitptr;
+
+ cp = buf;
+ ep = cp + sizeof(buf);
+ *cp++ = '$';
+
#if defined(__STDC__)
va_start(ap, fmt);
#else
va_start(ap);
#endif /* __STDC__ */
+ n = VSNPRINTF((cp, (size_t)(ep - cp), fmt, ap));
+ va_end(ap);
+ if (n < 0 || (size_t)n >= (size_t)(ep - cp))
+ goto overflow;
- pp = peer->procptr;
- up = pp->unitptr;
-
- cp = buf;
- *cp++ = '$';
- n = VSNPRINTF((cp, sizeof(buf) - 1, fmt, ap));
ck = mx4200_cksum(cp, n);
+ cp += n;
+ n = SNPRINTF((cp, (size_t)(ep - cp), "*%02X\r\n", ck));
+ if (n < 0 || (size_t)n >= (size_t)(ep - cp))
+ goto overflow;
cp += n;
- ++n;
- n += SNPRINTF((cp, sizeof(buf) - n - 5, "*%02X\r\n", ck));
-
- m = write(pp->io.fd, buf, (unsigned)n);
+ m = write(pp->io.fd, buf, (unsigned)(cp - buf));
if (m < 0)
msyslog(LOG_ERR, "mx4200_send: write: %m (%s)", buf);
mx4200_debug(peer, "mx4200_send: %d %s\n", m, buf);
- va_end(ap);
+
+ overflow:
+ msyslog(LOG_ERR, "mx4200_send: %s", "data exceeds buffer size");
}
#else