Subject: Bug#4420: rwho doesn't limit tty name field

From: Herbert Thielen <[email-masked]>
Date: Fri, 6 Sep 1996 15:47:40 +0200 (MET DST)

Package: netstd
Version: 2.07-1

rwho doesn't limit the tty name field ``out_line'' to 8 characters. This
leads to strange output lines if the line field in the utmp entry of any
host uses 8 or more characters, as it's often if xdm creates an utmp
entry.

e.g.:

	gfullner batian:ibm16.lpgfullner02batian Sep  6 14:24
			<-o.k.-><---- overflow ---->
	                12345678

In this example, ``ibm16.lp'' are the first 8 characters of the full
hostname of an X terminal which was served by batian's xdm. This example
is extremely bad as the user name has 8 characters too, so not only
out_name gets printed after out_line, but out_time and some more data
following it in memory. From /usr/include/protocols/rwhod.h:

	/*
	 * rwho protocol packet format.
	 */
	struct	outmp {
		char	out_line[8];		/* tty name */
		char	out_name[8];		/* user id */
		long	out_time;		/* time on */
	};
	[...]

Its easy to limit the tty name as it is done already for the user id.
The patch for rwho.c follows.

This error occurs on all UNIX variants we have in our network (SunOS
4.1.3, AIX 3.2.5, Digital Unix 3.2, MIPS RISC/os 4.52b) and can be found
in OpenBSD sources too, so Debian is not alone :-)

Regards
	Herbert.

--- rwho.c.old	Sat May 11 17:49:10 1991
+++ rwho.c	Fri Sep  6 14:40:18 1996
@@ -130,7 +130,7 @@
 	mp = myutmp;
 	for (i = 0; i < nusers; i++) {
 		char buf[BUFSIZ];
-		(void)sprintf(buf, "%s:%s", mp->myhost, mp->myutmp.out_line);
+		(void)sprintf(buf, "%s:%.8s", mp->myhost, mp->myutmp.out_line);
 		printf("%-8.8s %-*s %.12s",
 		   mp->myutmp.out_name,
 		   width,