commit 77dd9917e79cab1e9bc1327a37809606858bca94
Author: Miroslav Lichvar <mlichvar@redhat.com>
Date:   Thu Aug 20 10:17:02 2015 +0200

    Don't allow setting driftfile and pidfile remotely

diff --git a/ntpd/ntp_parser.y b/ntpd/ntp_parser.y
index 149ecce..b8971d5 100644
--- a/ntpd/ntp_parser.y
+++ b/ntpd/ntp_parser.y
@@ -1225,11 +1225,11 @@ misc_cmd_int_keyword
 misc_cmd_str_keyword
 	:	T_Ident
 	|	T_Leapfile
-	|	T_Pidfile
 	;
 
 misc_cmd_str_lcl_keyword
 	:	T_Logfile
+	|	T_Pidfile
 	|	T_Saveconfigdir
 	;
 
@@ -1238,24 +1238,38 @@ drift_parm
 		{
 			attr_val *av;
 
-			av = create_attr_sval(T_Driftfile, $1);
-			APPEND_G_FIFO(cfgt.vars, av);
+			if (lex_from_file()) {
+				av = create_attr_sval(T_Driftfile, $1);
+				APPEND_G_FIFO(cfgt.vars, av);
+			} else {
+				YYFREE($1);
+				yyerror("driftfile remote configuration ignored");
+			}
 		}
 	|	T_String T_Double
 		{
 			attr_val *av;
 
-			av = create_attr_sval(T_Driftfile, $1);
-			APPEND_G_FIFO(cfgt.vars, av);
-			av = create_attr_dval(T_WanderThreshold, $2);
-			APPEND_G_FIFO(cfgt.vars, av);
+			if (lex_from_file()) {
+				av = create_attr_sval(T_Driftfile, $1);
+				APPEND_G_FIFO(cfgt.vars, av);
+				av = create_attr_dval(T_WanderThreshold, $2);
+				APPEND_G_FIFO(cfgt.vars, av);
+			} else {
+				YYFREE($1);
+				yyerror("driftfile remote configuration ignored");
+			}
 		}
 	|	/* Null driftfile,  indicated by empty string "" */
 		{
 			attr_val *av;
 
-			av = create_attr_sval(T_Driftfile, estrdup(""));
-			APPEND_G_FIFO(cfgt.vars, av);
+			if (lex_from_file()) {
+				av = create_attr_sval(T_Driftfile, estrdup(""));
+				APPEND_G_FIFO(cfgt.vars, av);
+			} else {
+				yyerror("driftfile remote configuration ignored");
+			}
 		}
 	;