4 files changed, 42 insertions, 41 deletions

diff --git a/UPDATING b/UPDATING
index 5fd5b35fc3b4..dfb95305f995 100644
--- a/UPDATING
+++ b/UPDATING
@@ -8,6 +8,10 @@ Items affecting the ports and packages system can be found in
 /usr/ports/UPDATING.  Please read that file before running
 portupgrade.
 
+20080118:		FreeBSD-SA-08:01.pty, FreeBSD-SA-08:02.libc
+	Fix issues which allow snooping on ptys. [08:01]
+	Fix an off-by-one error in inet_network(3). [08:02]
+
 20071126:
 	The AT keyboard emulation of sunkbd(4) has been turned on
 	by default. In order to make the special symbols of the Sun
diff --git a/lib/libc/inet/inet_network.c b/lib/libc/inet/inet_network.c
index b464656369f0..254db41acb2d 100644
--- a/lib/libc/inet/inet_network.c
+++ b/lib/libc/inet/inet_network.c
@@ -82,9 +82,9 @@ again:
 	}
 	if (!digit)
 		return (INADDR_NONE);
+	if (pp >= parts + 4 || val > 0xffU)
+		return (INADDR_NONE);
 	if (*cp == '.') {
-		if (pp >= parts + 4 || val > 0xffU)
-			return (INADDR_NONE);
 		*pp++ = val, cp++;
 		goto again;
 	}
diff --git a/lib/libc/stdlib/grantpt.c b/lib/libc/stdlib/grantpt.c
index a3365c935377..1d67607ec3d1 100644
--- a/lib/libc/stdlib/grantpt.c
+++ b/lib/libc/stdlib/grantpt.c
@@ -84,14 +84,6 @@ __FBSDID("$FreeBSD$");
 			 minor((x).st_rdev) < PTY_MAX)
 
 
-static int
-is_pts(int fd)
-{
-	int nb;
-
-	return (_ioctl(fd, TIOCGPTN, &nb) == 0);
-}
-
 #if 0
 int
 __use_pts(void)
@@ -255,33 +247,43 @@ char *
 ptsname(int fildes)
 {
 	static char pty_slave[] = _PATH_DEV PTYS_PREFIX "XY";
+#if 0
 	static char ptmx_slave[] = _PATH_DEV PTMXS_PREFIX "4294967295";
-	char *retval;
+#endif
+	const char *master;
 	struct stat sbuf;
+#if 0
+	int ptn;
 
-	retval = NULL;
-
-	if (_fstat(fildes, &sbuf) == 0) {
-		if (!ISPTM(sbuf))
-			errno = EINVAL;
-		else {
-			if (!is_pts(fildes)) {
-				(void)snprintf(pty_slave, sizeof(pty_slave),
-					       _PATH_DEV PTYS_PREFIX "%s",
-					       devname(sbuf.st_rdev, S_IFCHR) +
-					       strlen(PTYM_PREFIX));
-				retval = pty_slave;
-			} else {
-				(void)snprintf(ptmx_slave, sizeof(ptmx_slave),
-					       _PATH_DEV PTMXS_PREFIX "%s",
-					       devname(sbuf.st_rdev, S_IFCHR) +
-					       strlen(PTMXM_PREFIX));
-				retval = ptmx_slave;
-			}
-		}
+	/* Handle pts(4) masters first. */
+	if (_ioctl(fildes, TIOCGPTN, &ptn) == 0) {
+		(void)snprintf(ptmx_slave, sizeof(ptmx_slave),
+		    _PATH_DEV PTMXS_PREFIX "%d", ptn);
+		return (ptmx_slave);
 	}
+#endif
 
-	return (retval);
+	/* All master pty's must be char devices. */
+	if (_fstat(fildes, &sbuf) == -1)
+		goto invalid;
+	if (!S_ISCHR(sbuf.st_mode))
+		goto invalid;
+
+	/* Check to see if this device is a pty(4) master. */
+	master = devname(sbuf.st_rdev, S_IFCHR);
+	if (strlen(master) != strlen(PTYM_PREFIX "XY"))
+		goto invalid;
+	if (strncmp(master, PTYM_PREFIX, strlen(PTYM_PREFIX)) != 0)
+		goto invalid;
+
+	/* It is, so generate the corresponding pty(4) slave name. */
+	(void)snprintf(pty_slave, sizeof(pty_slave), _PATH_DEV PTYS_PREFIX "%s",
+	    master + strlen(PTYM_PREFIX));
+	return (pty_slave);
+
+invalid:
+	errno = EINVAL;
+	return (NULL);
 }
 
 /*
@@ -290,18 +292,14 @@ ptsname(int fildes)
 int
 unlockpt(int fildes)
 {
-	int retval;
-	struct stat sbuf;
 
 	/*
 	 * Unlocking a master/slave pseudo-terminal pair has no meaning in a
 	 * non-streams PTY environment.  However, we do ensure fildes is a
 	 * valid master pseudo-terminal device.
 	 */
-	if ((retval = _fstat(fildes, &sbuf)) == 0 && !ISPTM(sbuf)) {
-		errno = EINVAL;
-		retval = -1;
-	}
+	if (ptsname(fildes) == NULL)
+		return (-1);
 
-	return (retval);
+	return (0);
 }
diff --git a/lib/libutil/pty.c b/lib/libutil/pty.c
index 79bb88e61363..d6885ba0b6d6 100644
--- a/lib/libutil/pty.c
+++ b/lib/libutil/pty.c
@@ -121,8 +121,7 @@ openpty(int *amaster, int *aslave, char *name, struct termios *termp, struct win
 					break; /* try the next pty group */
 			} else {
 				line[5] = 't';
-				(void) chown(line, getuid(), ttygid);
-				(void) chmod(line, S_IRUSR|S_IWUSR|S_IWGRP);
+				(void) grantpt(master);
 				(void) revoke(line);
 				if ((slave = open(line, O_RDWR, 0)) != -1) {
 					*amaster = master;