12 files changed, 72 insertions, 23 deletions

diff --git a/lib/utils_cmd.c b/lib/utils_cmd.c
index 4c6d0be1..9e214bd4 100644
--- a/lib/utils_cmd.c
+++ b/lib/utils_cmd.c
@@ -390,6 +390,9 @@ cmd_file_read ( char *filename, output *out, int flags)
         
         if(out)
                 out->lines = _cmd_fetch_output (fd, out, flags);
+        
+        if (close(fd) == -1)
+                die( STATE_UNKNOWN, _("Error closing %s: %s"), filename, strerror(errno) );
 
         return 0;
 }
diff --git a/plugins-root/check_dhcp.c b/plugins-root/check_dhcp.c
index 1ec5c396..b69a10da 100644
--- a/plugins-root/check_dhcp.c
+++ b/plugins-root/check_dhcp.c
@@ -837,7 +837,7 @@ int add_dhcp_offer(struct in_addr source,dhcp_packet *offer_packet){
                 return ERROR;
 
         /* process all DHCP options present in the packet */
-        for(x=4;x<MAX_DHCP_OPTIONS_LENGTH;){
+        for(x=4;x<MAX_DHCP_OPTIONS_LENGTH-1;){
 
                 if((int)offer_packet->options[x]==-1)
                         break;
diff --git a/plugins/check_apt.c b/plugins/check_apt.c
index 4c76a512..07622c2f 100644
--- a/plugins/check_apt.c
+++ b/plugins/check_apt.c
@@ -223,6 +223,9 @@ int run_upgrade(int *pkgcount, int *secpkgcount){
         regex_t ireg, ereg, sreg;
         char *cmdline=NULL, rerrbuf[64];
 
+        /* initialize ereg as it is possible it is printed while uninitialized */
+        memset(&ereg, "\0", sizeof(ereg.buffer));
+
         if(upgrade==NO_UPGRADE) return STATE_OK;
 
         /* compile the regexps */
diff --git a/plugins/check_dns.c b/plugins/check_dns.c
index eebe72cc..31a953d7 100644
--- a/plugins/check_dns.c
+++ b/plugins/check_dns.c
@@ -242,7 +242,23 @@ main (int argc, char **argv)
     }
     printf (ngettext("%.3f second response time", "%.3f seconds response time", elapsed_time), elapsed_time);
     printf (_(". %s returns %s"), query_address, address);
-    printf ("|%s\n", fperfdata ("time", elapsed_time, "s", FALSE, 0, FALSE, 0, TRUE, 0, FALSE, 0));
+    if ((time_thresholds->warning != NULL) && (time_thresholds->critical != NULL)) {
+      printf ("|%s\n", fperfdata ("time", elapsed_time, "s",
+                                  TRUE, time_thresholds->warning->end,
+                                  TRUE, time_thresholds->critical->end,
+                                  TRUE, 0, FALSE, 0));
+    } else if ((time_thresholds->warning == NULL) && (time_thresholds->critical != NULL)) {
+      printf ("|%s\n", fperfdata ("time", elapsed_time, "s",
+                                  FALSE, 0,
+                                  TRUE, time_thresholds->critical->end,
+                                  TRUE, 0, FALSE, 0));
+    } else if ((time_thresholds->warning != NULL) && (time_thresholds->critical == NULL)) {
+      printf ("|%s\n", fperfdata ("time", elapsed_time, "s",
+                                  TRUE, time_thresholds->warning->end,
+                                  FALSE, 0,
+                                  TRUE, 0, FALSE, 0));
+    } else
+      printf ("|%s\n", fperfdata ("time", elapsed_time, "s", FALSE, 0, FALSE, 0, TRUE, 0, FALSE, 0));
   }
   else if (result == STATE_WARNING)
     printf (_("DNS WARNING - %s\n"),
diff --git a/plugins/check_http.c b/plugins/check_http.c
index 92861d97..51679975 100644
--- a/plugins/check_http.c
+++ b/plugins/check_http.c
@@ -1243,6 +1243,7 @@ redir (char *pos, char *status_line)
   if (addr == NULL)
     die (STATE_UNKNOWN, _("HTTP UNKNOWN - Could not allocate addr\n"));
 
+  memset(addr, 0, MAX_IPV4_HOSTLENGTH);
   url = malloc (strcspn (pos, "\r\n"));
   if (url == NULL)
     die (STATE_UNKNOWN, _("HTTP UNKNOWN - Could not allocate URL\n"));
@@ -1333,8 +1334,8 @@ redir (char *pos, char *status_line)
          max_depth, type, addr, i, url, (display_html ? "</A>" : ""));
 
   if (server_port==i &&
-      !strcmp(server_address, addr) &&
-      (host_name && !strcmp(host_name, addr)) &&
+      !strncmp(server_address, addr, MAX_IPV4_HOSTLENGTH) &&
+      (host_name && !strncmp(host_name, addr, MAX_IPV4_HOSTLENGTH)) &&
       !strcmp(server_url, url))
     die (STATE_WARNING,
          _("HTTP WARNING - redirection creates an infinite loop - %s://%s:%d%s%s\n"),
@@ -1343,11 +1344,11 @@ redir (char *pos, char *status_line)
   strcpy (server_type, type);
 
   free (host_name);
-  host_name = strdup (addr);
+  host_name = strndup (addr, MAX_IPV4_HOSTLENGTH);
 
   if (!(followsticky & STICKY_HOST)) {
     free (server_address);
-    server_address = strdup (addr);
+    server_address = strndup (addr, MAX_IPV4_HOSTLENGTH);
   }
   if (!(followsticky & STICKY_PORT)) {
     server_port = i;
@@ -1366,6 +1367,7 @@ redir (char *pos, char *status_line)
     printf (_("Redirection to %s://%s:%d%s\n"), server_type,
             host_name ? host_name : server_address, server_port, server_url);
 
+  free(addr);
   check_http ();
 }
 
diff --git a/plugins/check_nt.c b/plugins/check_nt.c
index cacf6651..fefbfb7a 100644
--- a/plugins/check_nt.c
+++ b/plugins/check_nt.c
@@ -293,10 +293,10 @@ int main(int argc, char **argv){
 
                 /* Divisor should be 1048567, not 3044515, as we are measuring "Commit Charge" here,
                 which equals RAM + Pagefiles. */
-                xasprintf(&output_message,_("Memory usage: total:%.2f Mb - used: %.2f Mb (%.0f%%) - free: %.2f Mb (%.0f%%)"),
+                xasprintf(&output_message,_("Memory usage: total:%.2f MB - used: %.2f MB (%.0f%%) - free: %.2f MB (%.0f%%)"),
                   mem_commitLimit / 1048567, mem_commitByte / 1048567, percent_used_space,
                   (mem_commitLimit - mem_commitByte) / 1048567, (mem_commitLimit - mem_commitByte) / mem_commitLimit * 100);
-                xasprintf(&perfdata,_("'Memory usage'=%.2fMb;%.2f;%.2f;0.00;%.2f"), mem_commitByte / 1048567,
+                xasprintf(&perfdata,_("'Memory usage'=%.2fMB;%.2f;%.2f;0.00;%.2f"), mem_commitByte / 1048567,
                   warning_used_space / 1048567, critical_used_space / 1048567, mem_commitLimit / 1048567);
 
                 return_code=STATE_OK;
diff --git a/plugins/check_ntp.c b/plugins/check_ntp.c
index 0a7640a7..09a923eb 100644
--- a/plugins/check_ntp.c
+++ b/plugins/check_ntp.c
@@ -517,13 +517,14 @@ setup_control_request(ntp_control_message *p, uint8_t opcode, uint16_t seq){
 double jitter_request(const char *host, int *status){
         int conn=-1, i, npeers=0, num_candidates=0, syncsource_found=0;
         int run=0, min_peer_sel=PEER_INCLUDED, num_selected=0, num_valid=0;
-        int peers_size=0, peer_offset=0;
+        int peers_size=0, peer_offset=0, bytes_read=0;
         ntp_assoc_status_pair *peers=NULL;
         ntp_control_message req;
         const char *getvar = "jitter";
         double rval = 0.0, jitter = -1.0;
         char *startofvalue=NULL, *nptr=NULL;
         void *tmp;
+        int ntp_cm_ints = sizeof(uint16_t) * 5 + sizeof(uint8_t) * 2;
 
         /* Long-winded explanation:
          * Getting the jitter requires a number of steps:
@@ -608,7 +609,15 @@ double jitter_request(const char *host, int *status){
 
                                 req.count = htons(MAX_CM_SIZE);
                                 DBG(printf("recieving READVAR response...\n"));
-                                read(conn, &req, SIZEOF_NTPCM(req));
+
+                                /* cov-66524 - req.data not null terminated before usage. Also covers verifying struct was returned correctly*/
+                                if ((bytes_read = read(conn, &req, SIZEOF_NTPCM(req))) == -1)
+                                        die(STATE_UNKNOWN, _("Cannot read from socket: %s"), strerror(errno));
+                                if (bytes_read != ntp_cm_ints + req.count)
+                                        die(STATE_UNKNOWN, _("Invalid NTP response: %d bytes read does not equal %d plus %d data segment"), bytes_read, ntp_cm_ints, req.count); 
+                                /* else null terminate */
+                                strncpy(req.data[req.count], "\0", 1);
+
                                 DBG(print_ntp_control_message(&req));
 
                                 if(req.op&REM_ERROR && strstr(getvar, "jitter")) {
diff --git a/plugins/check_real.c b/plugins/check_real.c
index 47776c5b..36f64134 100644
--- a/plugins/check_real.c
+++ b/plugins/check_real.c
@@ -178,6 +178,7 @@ main (int argc, char **argv)
 
                 /* watch for the REAL connection string */
                 result = recv (sd, buffer, MAX_INPUT_BUFFER - 1, 0);
+                buffer[result] = "\0"; /* null terminate recieved buffer */
 
                 /* return a CRITICAL status if we couldn't read any data */
                 if (result == -1) {
diff --git a/plugins/check_ssh.c b/plugins/check_ssh.c
index f4522e2b..b6187d61 100644
--- a/plugins/check_ssh.c
+++ b/plugins/check_ssh.c
@@ -46,6 +46,7 @@ const char *email = "devel@monitoring-plugins.org";
 int port = -1;
 char *server_name = NULL;
 char *remote_version = NULL;
+char *remote_protocol = NULL;
 int verbose = FALSE;
 
 int process_arguments (int, char **);
@@ -53,7 +54,7 @@ int validate_arguments (void);
 void print_help (void);
 void print_usage (void);
 
-int ssh_connect (char *haddr, int hport, char *remote_version);
+int ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol);
 
 
 
@@ -78,7 +79,7 @@ main (int argc, char **argv)
         alarm (socket_timeout);
 
         /* ssh_connect exits if error is found */
-        result = ssh_connect (server_name, port, remote_version);
+        result = ssh_connect (server_name, port, remote_version, remote_protocol);
 
         alarm (0);
 
@@ -105,6 +106,7 @@ process_arguments (int argc, char **argv)
                 {"timeout", required_argument, 0, 't'},
                 {"verbose", no_argument, 0, 'v'},
                 {"remote-version", required_argument, 0, 'r'},
+                {"remote-protcol", required_argument, 0, 'P'},
                 {0, 0, 0, 0}
         };
 
@@ -116,7 +118,7 @@ process_arguments (int argc, char **argv)
                         strcpy (argv[c], "-t");
 
         while (1) {
-                c = getopt_long (argc, argv, "+Vhv46t:r:H:p:", longopts, &option);
+                c = getopt_long (argc, argv, "+Vhv46t:r:H:p:P:", longopts, &option);
 
                 if (c == -1 || c == EOF)
                         break;
@@ -152,6 +154,9 @@ process_arguments (int argc, char **argv)
                 case 'r':                                                                       /* remote version */
                         remote_version = optarg;
                         break;
+                case 'P':                                                                       /* remote version */
+                        remote_protocol = optarg;
+                        break;
                 case 'H':                                                                       /* host */
                         if (is_host (optarg) == FALSE)
                                 usage2 (_("Invalid hostname/address"), optarg);
@@ -206,7 +211,7 @@ validate_arguments (void)
 
 
 int
-ssh_connect (char *haddr, int hport, char *remote_version)
+ssh_connect (char *haddr, int hport, char *remote_version, char *remote_protocol)
 {
         int sd;
         int result;
@@ -254,6 +259,14 @@ ssh_connect (char *haddr, int hport, char *remote_version)
                         exit (STATE_WARNING);
                 }
 
+                if (remote_protocol && strcmp(remote_protocol, ssh_proto)) {
+                        printf
+                                (_("SSH WARNING - %s (protocol %s) protocol version mismatch, expected '%s'\n"),
+                                 ssh_server, ssh_proto, remote_protocol);
+                        close(sd);
+                        exit (STATE_WARNING);
+                }
+
                 elapsed_time = (double)deltime(tv) / 1.0e6;
 
                 printf
@@ -296,6 +309,9 @@ print_help (void)
         printf (" %s\n", "-r, --remote-version=STRING");
   printf ("    %s\n", _("Warn if string doesn't match expected server version (ex: OpenSSH_3.9p1)"));
 
+        printf (" %s\n", "-P, --remote-protocol=STRING");
+  printf ("    %s\n", _("Warn if protocol doesn't match expected protocol version (ex: 2.0)"));
+
         printf (UT_VERBOSE);
 
         printf (UT_SUPPORT);
diff --git a/plugins/check_tcp.c b/plugins/check_tcp.c
index b0459f2b..bd7736b5 100644
--- a/plugins/check_tcp.c
+++ b/plugins/check_tcp.c
@@ -32,13 +32,12 @@ char *progname;
 const char *copyright = "1999-2008";
 const char *email = "devel@monitoring-plugins.org";
 
-#include <ctype.h>
-
 #include "common.h"
 #include "netutils.h"
 #include "utils.h"
 #include "utils_tcp.h"
 
+#include <ctype.h>
 #include <sys/select.h>
 
 #ifdef HAVE_SSL
diff --git a/plugins/negate.c b/plugins/negate.c
index 4bd09deb..beaed1ea 100644
--- a/plugins/negate.c
+++ b/plugins/negate.c
@@ -35,16 +35,16 @@ const char *email = "devel@monitoring-plugins.org";
 
 #define DEFAULT_TIMEOUT 11
 
-#include <ctype.h>
-
 #include "common.h"
 #include "utils.h"
 #include "utils_cmd.h"
 
+#include <ctype.h>
+
 /* char *command_line; */
 
 static const char **process_arguments (int, char **);
-int validate_arguments (char **);
+void validate_arguments (char **);
 void print_help (void);
 void print_usage (void);
 int subst_text = FALSE;
@@ -98,8 +98,7 @@ main (int argc, char **argv)
                 die (max_state_alt (result, STATE_UNKNOWN), _("No data returned from command\n"));
 
         for (i = 0; i < chld_out.lines; i++) {
-                if (subst_text && result != state[result] &&
-                    result >= 0 && result <= 4) {
+                if (subst_text && result >= 0 && result <= 4 && result != state[result])  {
                         /* Loop over each match found */
                         while ((sub = strstr (chld_out.line[i], state_text (result)))) {
                                 /* Terminate the first part and skip over the string we'll substitute */
@@ -206,7 +205,7 @@ process_arguments (int argc, char **argv)
 }
 
 
-int
+void
 validate_arguments (char **command_line)
 {
         if (command_line[0] == NULL)
diff --git a/plugins/t/check_dns.t b/plugins/t/check_dns.t
index 2c903db9..4ff553f7 100644
--- a/plugins/t/check_dns.t
+++ b/plugins/t/check_dns.t
@@ -10,7 +10,7 @@ use NPTest;
 
 plan skip_all => "check_dns not compiled" unless (-x "check_dns");
 
-plan tests => 13;
+plan tests => 14;
 
 my $successOutput = '/DNS OK: [\.0-9]+ seconds? response time/';
 
@@ -54,6 +54,7 @@ cmp_ok( $res->return_code, '==', 2, "Critical threshold passed");
 
 $res = NPTest->testCmd("./check_dns -H $hostname_valid -t 5 -w 0 -c 5");
 cmp_ok( $res->return_code, '==', 1, "Warning threshold passed");
+like( $res->output, "/\|time=[\d\.]+s;0.0*;5\.0*;0\.0*/", "Output performance data OK" );
 
 $res = NPTest->testCmd("./check_dns -H $hostname_invalid -t 1");
 cmp_ok( $res->return_code, '==', 2, "Invalid $hostname_invalid");