fping 5.4 (security fix release)

[schweikert]

@auerswal @gsnw-sebast : I plan to do a fping 5.4 release soon with just these changes:

#405

That PR is still open, but I will probably merge it tomorrow.

Let me know if there are any other changes that should also go in. All the new developments that were done since the fping 5.3 release will then go into a fping 5.5.

[auerswal]

Hi @schweikert,

• The change adding missing NULL checks after calloc() looks good. I've grepped for other missing instances and found none.
• The off-by-one fix in the seqmap code also looks good.
• The -i and -p changes look incomplete, though. They could also use a more informative commit message and a change log entry. I am not sure about those.

I don't think any of the other changes should go into a security fix release (I'm not even sure about the rate limit changes). Closest would be PR #378, because the previous code allowed to obscure target names in an input file with a sufficiently long prefix, but it's a large change for a small problem.

[schweikert]

Thanks Erik. I updated the commit message, added a comment in the code, and also updated the changelog. The idea is to avoid trying to do a memory allocation with an unreasonable size (the per-host interval is used as denominator in a calculation of the required allocation size).

[auerswal]

Thanks for the explanation!

At first I thought that the safe limits were removed, because the code checking them now is unconditional. But the configure flag --enable-safe-limits still has a function, and thus needs to stay, both in the code and the documentation.

You could consider adding the new -p limit to the man page.

The pull request looks good.

[auerswal]

OK, I'm confused. The change log mentions a new limit for -i, the code defines MIN_PERHOST_INTERVAL_MS to 0.001, but the error message in the code uses -p when checking the MIN_PERHOST_INTERVAL_MS value. Did you mix up -i and -p in the error messages?

[schweikert]

You are right, thanks. I fixed the changelog entry.

[gsnw-sebast]

A little late, but I have no objections to the final result.
I've updated my PR branches. Thank you.