6373357 ipfilter tools need to check return values from memory allocation

11 files changed, 107 insertions, 6 deletions

diff --git a/usr/src/cmd/ipf/tools/ip_fil.c b/usr/src/cmd/ipf/tools/ip_fil.c
index 59daef293d..ae11de166e 100644
--- a/usr/src/cmd/ipf/tools/ip_fil.c
+++ b/usr/src/cmd/ipf/tools/ip_fil.c
@@ -611,6 +611,14 @@ int v;
 	if (*s && isdigit(*s)) {
 		ifp->if_unit = atoi(s);
 		ifp->if_name = (char *)malloc(s - name + 1);
+		if (ifp->if_name == NULL) {
+			/*
+			 * XXX do it more elegantly: free up mem,
+			 * return NULL
+			 */
+			perror("malloc");
+			exit(1);
+		}
 		strncpy(ifp->if_name, name, s - name);
 		ifp->if_name[s - name] = '\0';
 	} else {
diff --git a/usr/src/cmd/ipf/tools/ipf_y.y b/usr/src/cmd/ipf/tools/ipf_y.y
index a0d09fae71..f1fc0096f0 100644
--- a/usr/src/cmd/ipf/tools/ipf_y.y
+++ b/usr/src/cmd/ipf/tools/ipf_y.y
@@ -1782,6 +1782,8 @@ static void newrule()
 	frentry_t *frn;
 
 	frn = (frentry_t *)calloc(1, sizeof(frentry_t));
+	if (frn == NULL)
+		yyerror("sorry, out of memory");
 	for (fr = frtop; fr != NULL && fr->fr_next != NULL; fr = fr->fr_next)
 		;
 	if (fr != NULL)
@@ -1809,6 +1811,8 @@ static void setipftype()
 		if (fr->fr_type == FR_T_NONE) {
 			fr->fr_type = FR_T_IPF;
 			fr->fr_data = (void *)calloc(sizeof(fripf_t), 1);
+			if (fr->fr_data == NULL)
+				yyerror("sorry, out of memory");
 			fr->fr_dsize = sizeof(fripf_t);
 			fr->fr_ip.fi_v = frc->fr_v;
 			fr->fr_mip.fi_v = 0xf;
@@ -1833,11 +1837,15 @@ static frentry_t *addrule()
 	count = nrules;
 	if (count == 0) {
 		f = (frentry_t *)calloc(sizeof(*f), 1);
+		if (f == NULL)
+			yyerror("sorry, out of memory");
 		added++;
 		f2->fr_next = f;
 		bcopy(f2, f, sizeof(*f));
 		if (f2->fr_caddr != NULL) {
 			f->fr_caddr = malloc(f->fr_dsize);
+			if (f->fr_caddr == NULL)
+				yyerror("sorry, out of memory");
 			bcopy(f2->fr_caddr, f->fr_caddr, f->fr_dsize);
 		}
 		f->fr_next = NULL;
@@ -1846,12 +1854,16 @@ static frentry_t *addrule()
 	f = f2;
 	for (f1 = frc; count > 0; count--, f1 = f1->fr_next) {
 		f->fr_next = (frentry_t *)calloc(sizeof(*f), 1);
+		if (f->fr_next == NULL) 
+			yyerror("sorry, out of memory");
 		added++;
 		f = f->fr_next;
 		bcopy(f1, f, sizeof(*f));
 		f->fr_next = NULL;
 		if (f->fr_caddr != NULL) {
 			f->fr_caddr = malloc(f->fr_dsize);
+			if (f->fr_caddr == NULL)
+				yyerror("sorry, out of memory");
 			bcopy(f1->fr_caddr, f->fr_caddr, f->fr_dsize);
 		}
 	}
@@ -1906,10 +1918,14 @@ char *phrase;
 		if (!strncmp(phrase, "\"0x", 2)) {
 			phrase++;
 			fr->fr_data = malloc(4);
+			if (fr->fr_data == NULL)
+				yyerror("sorry, out of memory");
 
 			for (i = 0, s = strtok(phrase, " \r\n\t"; s != NULL;
 			     s = strtok(NULL, " \r\n\t"), i++) {
 				fr->fr_data = realloc(fr->fr_data, (i + 1) * 4);
+				if (fr->fr_data == NULL)
+					yyerror("sorry, out of memory");
 				l = (u_32_t)strtol(s, NULL, 0);
 				((u_32_t *)fr->fr_data)[i] = l;
 			}
@@ -1933,6 +1949,8 @@ char *phrase;
 
 		fr->fr_dsize = bpf.bf_len * sizeof(struct bpf_insn);
 		fr->fr_data = malloc(bpf.bf_len);
+		if (fr->fr_data == NULL)
+			yyerror("sorry, out of memory");
 		bcopy((char *)bpf.bf_insns, fr->fr_data, bpf.bf_len);
 		if (!bpf_validate(fr->fr_data, bpf.bf_len)) {
 			fprintf(stderr, "BPF validation failed\n");
@@ -1996,6 +2014,8 @@ alist_t *list;
 		n->ipn_info = a->al_not;
 		if (a->al_next != NULL) {
 			n->ipn_next = calloc(1, sizeof(*n));
+			if (n->ipn_next == NULL)
+				yyerror("sorry, out of memory");
 			n = n->ipn_next;
 		}
 	}
@@ -2038,6 +2058,8 @@ alist_t *list;
 		n->ipe_value = 0;
 		if (a->al_next != NULL) {
 			n->ipe_next = calloc(1, sizeof(*n));
+			if (n->ipe_next == NULL)
+				yyerror("sorry, out of memory");
 			n = n->ipe_next;
 		}
 	}
diff --git a/usr/src/cmd/ipf/tools/ipfcomp.c b/usr/src/cmd/ipf/tools/ipfcomp.c
index d06bf678ad..05e0202d73 100644
--- a/usr/src/cmd/ipf/tools/ipfcomp.c
+++ b/usr/src/cmd/ipf/tools/ipfcomp.c
@@ -152,9 +152,18 @@ frentry_t *fr;
 	int i;
 
 	f = (frentry_t *)malloc(sizeof(*f));
+	if (f == NULL) {
+		fprintf(stderr, "out of memory\n");
+		exit(1);
+	}
+
 	bcopy((char *)fr, (char *)f, sizeof(*fr));
 	if (fr->fr_ipf) {
 		f->fr_ipf = (fripf_t *)malloc(sizeof(*f->fr_ipf));
+		if (f->fr_ipf == NULL) {
+			fprintf(stderr, "out of memory\n");
+			exit(1);
+		}
 		bcopy((char *)fr->fr_ipf, (char *)f->fr_ipf,
 		      sizeof(*fr->fr_ipf));
 	}
@@ -167,6 +176,10 @@ frentry_t *fr;
 
 	if (g == NULL) {
 		g = (frgroup_t *)calloc(1, sizeof(*g));
+		if (g == NULL) {
+			fprintf(stderr, "out of memory\n");
+			exit(1);
+		}
 		g->fg_next = groups;
 		groups = g;
 		g->fg_head = f;
@@ -207,6 +220,10 @@ static u_long ipf%s_rule_data_%s_%u[] = {\n",
 				break;
 		if (g == NULL) {
 			g = (frgroup_t *)calloc(1, sizeof(*g));
+			if (g == NULL) {
+				fprintf(stderr, "out of memory\n");
+				exit(1);
+			}
 			g->fg_next = groups;
 			groups = g;
 			g->fg_head = f;
@@ -924,6 +941,10 @@ u_int incount, outcount;
 	}
 	if (n == NULL)
 		n = (mc_t *)malloc(sizeof(*n) * FRC_MAX);
+		if (n == NULL) {
+			fprintf(stderr, "out of memory\n");
+			exit(1);
+		}
 	bcopy((char *)m, (char *)n, sizeof(*n) * FRC_MAX);
 	sin = in;
 }
@@ -937,6 +958,10 @@ int dir;
 
 	if (m == NULL)
 		m = (mc_t *)calloc(1, sizeof(*m) * FRC_MAX);
+		if (m == NULL) {
+			fprintf(stderr, "out of memory\n");
+			exit(1);
+		}
 
 	for (g = groups; g != NULL; g = g->fg_next) {
 		if ((dir == 0) && ((g->fg_flags & FR_INQUE) != 0))
diff --git a/usr/src/cmd/ipf/tools/ipfs.c b/usr/src/cmd/ipf/tools/ipfs.c
index b886ef4f11..91ee4498ef 100644
--- a/usr/src/cmd/ipf/tools/ipfs.c
+++ b/usr/src/cmd/ipf/tools/ipfs.c
@@ -596,6 +596,8 @@ char *file;
 		} else {
 			ipn.ipn_dsize = 0;
 			in = (nat_save_t *)malloc(sizeof(*in));
+			if (in == NULL)
+				break;
 		}
 		bcopy((char *)ipnp, (char *)in, sizeof(ipn));
 
diff --git a/usr/src/cmd/ipf/tools/ipfstat.c b/usr/src/cmd/ipf/tools/ipfstat.c
index 6094d0cc3d..e3de41316c 100644
--- a/usr/src/cmd/ipf/tools/ipfstat.c
+++ b/usr/src/cmd/ipf/tools/ipfstat.c
@@ -772,6 +772,10 @@ char *comment;
 		if (type == FR_T_IPF || type == FR_T_BPFOPC) {
 			if (fp->fr_dsize) {
 				data = malloc(fp->fr_dsize);
+				if (data == NULL) {
+					perror("malloc");
+					exit(1);
+				}
 
 				if (kmemcpy(data, (u_long)fp->fr_data,
 					    fp->fr_dsize) == -1) {
@@ -879,6 +883,10 @@ ips_stat_t *ipsp;
 
 	sz = sizeof(*buckets) * ipsp->iss_statesize;
 	buckets = (u_long *)malloc(sz);
+	if (buckets == NULL) {
+		perror("malloc");
+		exit(1);
+	}
 	if (kmemcpy((char *)buckets, (u_long)ipsp->iss_bucketlen, sz)) {
 		free(buckets);
 		return;
@@ -1004,7 +1012,7 @@ int topclosed;
 		bzero((char *)&ipsst, sizeof(ipsst));
 		if ((ioctl(state_fd, SIOCGETFS, &ipfo) == -1)) {
 			perror("ioctl(SIOCGETFS)");
-			exit(-1);
+			break;
 		}
 
 		/* clear the history */
@@ -1043,7 +1051,7 @@ int topclosed;
 					tstable = realloc(tstable, maxtsentries * sizeof(statetop_t));
 					if (!tstable) {
 						perror("malloc");
-						exit(-1);
+						goto breakout;
 					}
 				}
 
@@ -1261,9 +1269,7 @@ int topclosed;
 			if (tolower(c) == 'l') {
 				redraw = 1;
 			} else if (tolower(c) == 'q') {
-				nocbreak();
-				endwin();
-				exit(0);
+				break;
 			} else if (tolower(c) == 'r') {
 				reverse = !reverse;
 			} else if (tolower(c) == 's') {
@@ -1274,11 +1280,13 @@ int topclosed;
 		}
 	} /* while */
 
+breakout:
 	printw("\n");
 	nocbreak();
 	endwin();
 
-	free(tstable);
+	if (tstable != NULL)
+		free(tstable);
 }
 #endif
 
diff --git a/usr/src/cmd/ipf/tools/ipftest.c b/usr/src/cmd/ipf/tools/ipftest.c
index 67552d3b5c..3ea511e326 100644
--- a/usr/src/cmd/ipf/tools/ipftest.c
+++ b/usr/src/cmd/ipf/tools/ipftest.c
@@ -207,6 +207,10 @@ char *argv[];
 		if (iface == NULL || *iface == '\0')
 			iface = ifname;
 		ifp = get_unit(iface, IP_V(ip));
+		if (ifp == NULL) {
+			fprintf(stderr, "out of memory\n");
+			exit(1);
+		}
 		if (!use_inet6) {
 			ip->ip_off = ntohs(ip->ip_off);
 			ip->ip_len = ntohs(ip->ip_len);
diff --git a/usr/src/cmd/ipf/tools/ipmon.c b/usr/src/cmd/ipf/tools/ipmon.c
index 8d8070c324..a654f7c3bd 100644
--- a/usr/src/cmd/ipf/tools/ipmon.c
+++ b/usr/src/cmd/ipf/tools/ipmon.c
@@ -921,6 +921,10 @@ int	logtype, blen;
 			if (bp)
 				bpo = bp;
 			bp = (char *)malloc(blen);
+			if (bp == NULL) {
+				perror("malloc");
+				exit(1);
+			}
 			bcopy((char *)ipl, bp, blen);
 			if (bpo) {
 				free(bpo);
diff --git a/usr/src/cmd/ipf/tools/ipmon_y.y b/usr/src/cmd/ipf/tools/ipmon_y.y
index 0df0058d24..b8ddb45de2 100644
--- a/usr/src/cmd/ipf/tools/ipmon_y.y
+++ b/usr/src/cmd/ipf/tools/ipmon_y.y
@@ -232,6 +232,8 @@ int type;
 	opt_t *o;
 
 	o = (opt_t *)malloc(sizeof(*o));
+	if (o == NULL)
+		yyerror("sorry, out of memory");
 	o->o_type = type;
 	o->o_line = yylineNum;
 	o->o_num = 0;
diff --git a/usr/src/cmd/ipf/tools/ipnat.c b/usr/src/cmd/ipf/tools/ipnat.c
index b97afb4f9b..e1d93224c6 100644
--- a/usr/src/cmd/ipf/tools/ipnat.c
+++ b/usr/src/cmd/ipf/tools/ipnat.c
@@ -345,6 +345,10 @@ natstat_t *nsp;
 
 	maptable = (hostmap_t **)malloc(sizeof(hostmap_t *) *
 					nsp->ns_hostmap_sz);
+	if (maptable == NULL) {
+		perror("malloc");
+		exit(1);
+	}
 	if (kmemcpy((char *)maptable, (u_long)nsp->ns_maptable,
 		    sizeof(hostmap_t *) * nsp->ns_hostmap_sz)) {
 		perror("kmemcpy (maptable)");
diff --git a/usr/src/cmd/ipf/tools/ippool_y.y b/usr/src/cmd/ipf/tools/ippool_y.y
index b9ba45c403..a952538c39 100644
--- a/usr/src/cmd/ipf/tools/ippool_y.y
+++ b/usr/src/cmd/ipf/tools/ippool_y.y
@@ -229,6 +229,8 @@ addrlist:
 grouplist:
 	groupentry next grouplist	{ $$ = $1; $1->ipe_next = $3; }
 	| addrmask next grouplist	{ $$ = calloc(1, sizeof(iphtent_t));
+					  if ($$ == NULL)
+						yyerror("sorry, out of memory");
 					  if  (set_ipv6_addr)
 					  	$$->ipe_family = AF_INET6;
 					  else
@@ -243,6 +245,8 @@ grouplist:
 	  				  $$->ipe_next = $3; }
 	| groupentry next		{ $$ = $1; }
 	| addrmask next			{ $$ = calloc(1, sizeof(iphtent_t));
+					  if ($$ == NULL)
+						yyerror("sorry, out of memory");
 					  if  (set_ipv6_addr)
 					  	$$->ipe_family = AF_INET6;
 					  else
@@ -264,6 +268,8 @@ setgrouplist:
 
 groupentry:
 	addrmask ',' setgroup	{ $$ = calloc(1, sizeof(iphtent_t));
+				  if ($$ == NULL)
+					yyerror("sorry, out of memory");
 				  if  (set_ipv6_addr)
 				  	$$->ipe_family = AF_INET6;
 				  else
@@ -281,6 +287,8 @@ groupentry:
 	;
 
 range:	addrmask	{ $$ = calloc(1, sizeof(*$$));
+			  if ($$ == NULL)
+				yyerror("sorry, out of memory");
 			  $$->ipn_info = 0;
 			  if (set_ipv6_addr) {
 				  $$->ipn_addr.adf_family = AF_INET6;
@@ -295,6 +303,8 @@ range:	addrmask	{ $$ = calloc(1, sizeof(*$$));
 			  set_ipv6_addr = 0;
 			}
 	| '!' addrmask	{ $$ = calloc(1, sizeof(*$$));
+			  if ($$ == NULL)
+				yyerror("sorry, out of memory");
 			  $$->ipn_info = 1;
 			  if (set_ipv6_addr) {
 				  $$->ipn_addr.adf_family = AF_INET6;
@@ -315,6 +325,8 @@ hashlist:
 
 hashentry:
 	addrmask 			{ $$ = calloc(1, sizeof(iphtent_t));
+					  if ($$ == NULL)
+						yyerror("sorry, out of memory");
 					  if  (set_ipv6_addr)
 					  	$$->ipe_family = AF_INET6;
 					  else
diff --git a/usr/src/cmd/ipf/tools/lexer.c b/usr/src/cmd/ipf/tools/lexer.c
index 2a49a26fbe..72425e4589 100644
--- a/usr/src/cmd/ipf/tools/lexer.c
+++ b/usr/src/cmd/ipf/tools/lexer.c
@@ -574,11 +574,21 @@ char *msg;
 		   yytokentype == YY_NUMBER) {
 		if (yystr == NULL) {
 			txt = yytexttostr(yypos, YYBUFSIZ);
+			if (txt == NULL) {
+				fprintf(stderr, "sorry, out of memory,"
+					" bailing out\n");
+				exit(1);
+			}
 			freetxt = 1;
 		} else
 			txt = yystr;
 	} else {
 		txt = yykeytostr(yytokentype);
+		if (txt == NULL) {
+			fprintf(stderr, "sorry, out of memory,"
+				" bailing out\n");
+			exit(1);
+		}
 	}
 	fprintf(stderr, "%s error at \"%s\", line %d\n", msg, txt, yylineNum);
 	if (freetxt == 1)