Commit Graph

1327 Commits

Author SHA1 Message Date
FRIGN 6372a8f227 Audit tail(1)
1) Specify default in manpage under flag.
2) Boolean and return value style fixes.
3) argv-argc-centric loop.
4) No need to check for argc == 1 before the fflag-subroutine.
5) Remove indentation.
6) Empty line before return.
2015-03-17 23:24:43 +01:00
FRIGN 3c5d0ce4ca Mark sync(1) as audited
Nothing to be done here.
2015-03-17 23:07:41 +01:00
FRIGN 32b9d76747 Audit strings(1)
Only smaller style-changes. I already refactored the underlying
logic a while ago.
2015-03-17 23:05:50 +01:00
FRIGN 3725d501b3 Audit split(1)
1) Refactor manpage, add STANDARDS section.
2) Boolean-style-changes.
3) Update usage, reflecting num-idiom also changed in the manpage.
4) Refactor error messages.
5) Also fclose stdin.
6) Empty line before return.
2015-03-17 22:59:48 +01:00
FRIGN 4d946a274f Audit renice(1)
1) Get rid of strtop(), which was a NiH-version of estrtonum().
2) Boolean-style-fixes.
3) Update usage, reflecting num-idiom, also update manpage accordingly.
4) Don't break after usage().
5) Rewrite main loop with *argv instead of argv[i].
6) Don't play around with who < 0 and stuff.
7) Rename status to ret for consistency.
2015-03-17 22:15:09 +01:00
FRIGN c7deb4f2b7 Audit printf(1)
Not a lot to do here, I wrote this less than a month ago. The only
thing I missed was the newline before return.
2015-03-17 21:43:01 +01:00
FRIGN 1bc002b44a Audit paste(1)
Well, basically there was not a lot to do, as I already (fortunately)
audited this code a while back.
There were only minor style-changes.
2015-03-17 21:34:38 +01:00
Evan Gates cf5114a133 untypedef expr, find, test, as is existing style in sbase 2015-03-17 20:04:26 +00:00
FRIGN 93fd817536 Add estrlcat() and estrlcpy()
It has become a common idiom in sbase to check strlcat() and strlcpy()
using

if (strl{cat, cpy}(dst, src, siz) >= siz)
        eprintf("path too long\n");

However, this was not carried out consistently and to this very day,
some tools employed unchecked calls to these functions, effectively
allowing silent truncations to happen, which in turn may lead to
security issues.
To finally put an end to this, the e*-functions detect truncation
automatically and the caller can lean back and enjoy coding without
trouble. :)
2015-03-17 11:24:49 +01:00
FRIGN a76d4943b5 Audit mktemp(1)
1) Unglobalize variables.
2) Sort local variables.
3) Use return instead of exit() in main().
4) Add empty line before return.
2015-03-17 11:01:33 +01:00
FRIGN 683d108387 Audit logname(1)
1) Add usage().
2) Idiomatic argv0-setter. We don't use arg.h, as we do not process
   flags or arguments.
3) Remove program-name from eprintf-call. This is done in the eprintf-
   function itself when the DEBUG-define is set.
   We'll activate it by default later.
4) Add empty line before return.
2015-03-17 00:44:18 +01:00
FRIGN fbda47b964 Rewrite foldline() in fold(1)
After the audit, I had this noted down as a TODO-item, but
considered the function to be tested enough to hold the line
until I came to rewrite it.
Admittedly, I didn't take a closer look at the previous loop
and there probably were some edge-cases which caused trouble, but
so far so good, the new version of this commit should be safe
and considered audited.
2015-03-16 19:26:42 +01:00
FRIGN 64da0d1ebc Audit kill(1)
1) Refactor the manpage with num-options, optimize wording to be more
   concise and to the point, pid also specifies process groups.
2) Make int sig const.
3) Remove prototypes.
4) /* not reached */ consistency.
5) Refactor usage() with eprintf.
6) Refactor arg-parser with a switch, use estrtonum
7) Use return instead of exit() in main()
8) argc-argv-correctness.
2015-03-16 12:37:46 +01:00
FRIGN ac01240800 Small style-fix in cat.c 2015-03-16 10:36:36 +01:00
sin f919f2f2a4 test: Fix -e, -r, -w and -x
We return 0 when the expression evaluates to true.  access() returns
0 on a successful call so check against that.
2015-03-13 23:44:18 +00:00
FRIGN 0f60227ea8 Remove judging word from head.1 and tail.1 as well
If it's obsolete, why include it?
No, the point here is that the ARGNUM-syntax has it's place among
us fellow neckbeards. Let's not degrade it.
2015-03-13 23:54:13 +01:00
FRIGN 942c3613bc Audit fold(1)
1) Use num-wording in the manpage, remove offensive remark against
   the beloved -num-syntax <3.
2) Style changes.
3) Report errors of getline.
4) argv-argc-centric argument loop.
5) Rename r to ret for consistency.
2015-03-13 23:50:09 +01:00
FRIGN 3fa85f0f5e Fix argument parsing in test(1) and chmod(1)
We just take the raw argument list as is. Using arg.h, arguments
beginning with - would have been "eaten up".
Writing a special "bailout" for arg.h was not a good option,
not because it's not impossible (done in 6 LOC), but because it
is a shoehorning around a corner case present for a few programs
which are broken by design by POSIX.
2015-03-13 23:50:09 +01:00
Evan Gates ad6da18ca6 increment pointer by runelen(delim) not 1 2015-03-13 13:42:03 +00:00
FRIGN c82425e128 Three bugfixes in mkdir(1)
1) Any path passed to mkdir -p beginning with '/' failed, because
   it would cut out the first '/' immediately, passing "" to mkdir.
2) Running mkdir -p with a path/to/dir without trailing '/' would
   not create the directory.
   This is due to a wrong flag-check I added in the main-loop.
   It should now work as expected.
3) With the p-flag given, don't report an error in case the last
   dir also exists.
2015-03-13 12:23:22 +01:00
FRIGN b12041365d Audit expand(1)
Not much to do here. Forgot a colon in the manpage and some style-
changes in the code.
2015-03-13 00:38:29 +01:00
FRIGN 9fd4a745f8 Add history and config-struct to recurse
For loop detection, a history is mandatory. In the process of also
adding a flexible struct to recurse, the recurse-definition was moved
to fs.h.
The motivation behind the struct is to allow easy extensions to the
recurse-function without having to change the prototypes of all
functions in the process.
Adding flags is really simple as well now.

Using the recursor-struct, it's also easier to see which defaults
apply to a program (for instance, which type of follow, ...).

Another change was to add proper stat-lstat-usage in recurse. It
was wrong before.
2015-03-13 00:29:48 +01:00
FRIGN 3b187f4826 Only call recurse() when path points to a directory in du(1)
This improves performance by ~30%.
2015-03-12 13:29:12 +01:00
FRIGN af61ba738c Refactor recurse()
Instead of allocating a buffer on each run, build a buf on the stack.
2015-03-12 13:22:37 +01:00
FRIGN c4e0080bbf Mark du(1) as audited in README 2015-03-11 23:31:26 +01:00
FRIGN 01de5df8e6 Audit du(1) and refactor recurse()
While auditing du(1) I realized that there's no way the over 100 lines
of procedures in du() would pass the audit.
Instead, I decided to rewrite this section using recurse() from libutil.
However, the issue was that you'd need some kind of payload to count
the number of bytes in the subdirectories and use them in the higher
hierarchies.
The solution is to add a "void *data" data pointer to each recurse-
function-prototype, which we might also be able to use in other
recurse-applications.
recurse() itself had to be augmented with a recurse_samedev-flag, which
basically prevents recurse from leaving the current device.

Now, let's take a closer look at the audit:
1) Removing the now unnecessary util-functions push, pop, xrealpath,
   rename print() to printpath(), localize some global variables.
2) Only pass the block count to nblks instead of the entire stat-
   pointer.
3) Fix estrtonum to use the minimum of LLONG_MAX and SIZE_MAX.
4) Use idiomatic argv+argc-loop
5) Report proper exit-status.
2015-03-11 23:21:52 +01:00
FRIGN 00ca97b279 Mark cut(1) and cron(1) as audited in README
I finished auditing cut(1) a few minutes ago, and cron(1) is an
upstream project which needs to be taken care of upstream (sin's call).
2015-03-11 17:33:08 +01:00
FRIGN c9de9dd3c2 Audit cut(1)
1) Add check to parselist() to warn about an empty list.
2) Remove all "cut: "-prefixes from error-messages and other style
   changes.
3) != -1 --> >= 0 and check for ferror on fp after getline.
4) Update usage with argv0.
5) argv-centric loop refactor
6) Properly report exit-status.
7) Add empty line before return.
2015-03-11 17:29:18 +01:00
FRIGN 011c81b21b Undef reallocarray in util.h before declaration
In case we link against the OpenBSD-libc, we want to avoid collisions.
2015-03-11 17:06:52 +01:00
FRIGN f1a1b7f994 Mark comm(1) as audited in README 2015-03-11 13:47:33 +01:00
FRIGN a4587b84f8 Audit comm(1)
1) Use the LIMIT()-macro in util.h instead of defining our own.
2) Drop nextline() and finish(), not needed anymore. Use
   fputs in printline instead of printf.
   --> BUGFIX: Finish exited with status 1, but actually should
               exit with status 0 if ferror(f) == 0.
3) Don't use /dev/fd/0 and use idiomatic <stdin> and fp = stdin
   instead.
4) Refactor loop to use getline() instead of some handrolled
   nextline-function.
   --> BUGFIX: Line-length was limited to LINE_MAX before, now
               it's factually unlimited.
5) Combine diff >= 0 and diff <= 0 into one loop with a beginning
   continue-condition (diff && i == (diff < 0)).
6) BUGFIX: If diff == 0, don't print one buffer after EOFing on the
           other.
2015-03-11 13:47:08 +01:00
sin 76ea3fdd52 cksum: Report exit status properly 2015-03-11 12:35:29 +00:00
FRIGN e11717ab3b Print usage() when -l and -s are both given in cmp(1)
This is unspecified behaviour, not undefined by POSIX. So we
break out here.
2015-03-11 13:31:08 +01:00
FRIGN 695153ac18 Audit cmp(1)
1) Remove the return-value-enum, which is not necessary for a simple
   program like this.
2) Don't disallow both l and s to be specified. This is undefined
   behaviour defined by POSIX, so we don't start demanding things
   from the user.
3) Replace exit() with return (we are in main).
4) Refactor main loop to never return in the loop, but actually
   set the same-value and break, which increases readability.
5) Remove the final fclose()'s. The OS will take care of them, no
   need to become cleansy here.
6) Use idiomatic return-value using same. This concludes the
   increase of readability in the main-loop.
2015-03-11 11:16:40 +01:00
FRIGN 833c2aebb4 Remove mallocarray(...) and use reallocarray(NULL, ...)
After a short correspondence with Otto Moerbeek it turned out
mallocarray() is only in the OpenBSD-Kernel, because the kernel-
malloc doesn't have realloc.
Userspace applications should rather use reallocarray with an
explicit NULL-pointer.

Assuming reallocarray() will become available in c-stdlibs in the
next few years, we nip mallocarray() in the bud to allow an easy
transition to a system-provided version when the day comes.
2015-03-11 10:50:18 +01:00
FRIGN d6818a3c5f Audit cksum(1)
1) Reorder local variables.
2) Cleanup error messages, use %zu for size_t.
3) combine putchar(' ') and fputs to substitute printf(" %s", s).
4) Fix usage().
5) argv-argc-usage-fix.
6) Add empty line before return.
2015-03-11 00:13:48 +01:00
FRIGN 3c33abc520 Implement mallocarray()
A function used only in the OpenBSD-Kernel as of now, but it surely
provides a helpful interface when you just don't want to make sure
the incoming pointer to erealloc() is really NULL so it behaves
like malloc, making it a bit more safer.

Talking about *allocarray(): It's definitely a major step in code-
hardening. Especially as a system administrator, you should be
able to trust your core tools without having to worry about segfaults
like this, which can easily lead to privilege escalation.

How do the GNU coreutils handle this?
$ strings -n 4611686018427387903
strings: invalid minimum string length -1
$ strings -n 4611686018427387904
strings: invalid minimum string length 0

They silently overflow...

In comparison, sbase:

$ strings -n 4611686018427387903
mallocarray: out of memory
$ strings -n 4611686018427387904
mallocarray: out of memory

The first out of memory is actually a true OOM returned by malloc,
whereas the second one is a detected overflow, which is not marked
in a special way.
Now tell me which diagnostic error-messages are easier to understand.
2015-03-10 22:19:19 +01:00
FRIGN 3b825735d8 Implement reallocarray()
Stateless and I stumbled upon this issue while discussing the
semantics of read, accepting a size_t but only being able to return
ssize_t, effectively lacking the ability to report successful
reads > SSIZE_MAX.
The discussion went along and we came to the topic of input-based
memory allocations. Basically, it was possible for the argument
to a memory-allocation-function to overflow, leading to a segfault
later.
The OpenBSD-guys came up with the ingenious reallocarray-function,
and I implemented it as ereallocarray, which automatically returns
on error.
Read more about it here[0].

A simple testcase is this (courtesy to stateless):
$ sbase-strings -n (2^(32|64) / 4)

This will segfault before this patch and properly return an OOM-
situation afterwards (thanks to the overflow-check in reallocarray).

[0]: http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man3/calloc.3
2015-03-10 21:23:36 +01:00
Hiltjo Posthuma 066a0306a1 fork: no need to _exit() on the error case 2015-03-10 20:05:18 +01:00
Quentin Rameau 82bebf8ce7 nl: add -l option 2015-03-10 12:55:06 +00:00
FRIGN a8bd21c0ab Use switch with fork()
Allows dropping a local variable if the explicit PID is not needed
and it makes it clearer what happens.
Also, one should always strive for consistency for cases like these.
2015-03-09 15:01:29 +01:00
FRIGN 6f207dac5f Don't return but _exit after failed exec*() and fork()
Quoting POSIX[0]:
"Care should be taken, also, to call _exit() rather than exit() if exec cannot be used, since
exit() flushes and closes standard I/O channels, thereby damaging the parent process' standard
I/O data structures. (Even with fork(), it is wrong to call exit(), since buffered data would
then be flushed twice.)"

[0]: http://pubs.opengroup.org/onlinepubs/009695399/functions/vfork.html
2015-03-09 01:12:59 +01:00
FRIGN 4414a17e1b Small global-var change to chgrp(1) 2015-03-09 00:42:23 +01:00
FRIGN 3a04302c66 Audit chown(1)
Similar to the chgrp(1)-audit:
1) Refactor manpage so it's actually fun to read
2) BUGFIX: Call (l)chown properly when the H-flag is specified
   (only when depth > 0)
3) BUGFIX: Call (l)chown properly when the h-flag is specified
   (only when depth = 0).
4) BUGFIX: Only recurse() in chgrp() when the initial chownf()
   succeeds.
5) Style fixes, argv-basing.
6) Rename status to ret for consistency.
7) Add blank line before return.
2015-03-09 00:42:23 +01:00
Hiltjo Posthuma 8f436abde6 style: document intentional fallthrough 2015-03-09 00:33:13 +01:00
FRIGN aa1a2391ba Use idiomatic return in setsid(1) 2015-03-09 00:25:54 +01:00
FRIGN fba669da88 Audit chgrp(1)
1) Refactor manpage so it's actually fun to read.
2) BUGFIX: Call (l)chown properly when the H-flag is specified
   (only when depth > 0).
3) BUGFIX: Call (l)chown properly when the h-flag is specified
   (only when depth = 0).
4) BUGFIX: Only recurse() in chgrp() when the initial chownf()
   succeeds.
5) Style fixes, argv-basing.
6) Rename status to ret for consistency.
7) Add blank line before return.
2015-03-08 23:31:59 +01:00
FRIGN 8ffa06b3dc Add little estrtonum()-range-fix 2015-03-08 21:35:16 +01:00
FRIGN 76ad86b2a3 Audit cal(1)
1) Update manpage with the num-syntax.
2) Use size_t for years and derivatives.
3) Use putchar instead of printf wherever possible.
4) Update usage().
5) Style changes.
2015-03-08 21:28:32 +01:00
FRIGN f140403fca Audit cols(1)
1) Refactor manpage.
2) De-globalize local values.
3) update usage().
4) sort local variable declarations.
5) fix wrong argument in strtonum (3 -> 1).
6) argc-argv style, boolean style.
7) check bytes > 0 before accessing b.lines[i][bytes - 1]
   relying on len only makes sense but let's not push it.
7) don't break on maxlen > (chars - 1) / 2. This didn't even
   make sense.
8) _correctly_ calculate cols and rows in a readable way.
9) Rewrite loop over rows and cols in a readable way and
   using putchar in a loop instead of printf-magic or fputs
   where not necessary.
2015-03-08 19:49:59 +01:00