tcgetattr problem [Was Re: 1.3.22: bug report: rlogin crashes when run from an existing rlogin session]

[Corinna Vinschen]

On Tue, Apr 15, 2003 at 10:19:45PM -0400, Pierre A. Humblet wrote:
> Here is the offending code from rlogin.c, with an extra printf
> int
> speed(fd)
> 	int fd;
> {
> 	struct termios tt;
> 
> 	(void)tcgetattr(fd, &tt);
>    fprintf(stderr, "Speed %d\n", cfgetispeed(&tt));
> 	return (speeds[(int)cfgetispeed(&tt)]);
> }
> Here is what happens
> 
> /usr/src/inetutils-1.3.2-20/rlogin: ./rlogin localhost
> Speed 15         <XXXXXXXXXXXXXXXXX
> Fanfare!!!
> You are successfully logged in to this server!!!
> 
> ~: cd /usr/src/inetutils-1.3.2-20/rlogin
> /usr/src/inetutils-1.3.2-20/rlogin: ./rlogin xxx
> Speed 38400      <XXXXXXXXXXXXXXXXXXX
> Segmentation fault (core dumped)
> 
> So in one case the speed is the #define B38400, in the other case
> it is 38400, causing an overflow from the speeds[] array.
> 
> Note that rlogin.c has an #if BSD >= 198810 and is currently using 
> the #else branch. The speed[] array is limited to speeds up to 38400.
> Is that enough?

I don't think it has to do with being enough.  B38400 is the highest
value defined by POSIX and it's sort of a placeholder for any higher
value than this.  Linux defines additional values (B57600...B230400)
but it also has a check mask (CBAUDEX) to test whether a value is
in the POSIX range or not.

I think I understand now the mechanism which produced these wrong
values.  I'll upload a corrected version of inetutils soon.

Thanks,
Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Developer                                mailto:cygwin@cygwin.com
Red Hat, Inc.

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/