Attachment 600700 Details for Bug 841180 – Resolve issues in decoding PCP namereq PDUs

[patch] Resolve issues in decoding PCP namereq PDUs

pcp_namereq (text/plain), 1.06 KB, created by Nathan Scott on 2012-07-27 06:29:04 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nathan Scott

Created: 2012-07-27 06:29:04 UTC

Size: 1.06 KB

patch

obsolete

>Index: secure-pcp/src/libpcp/src/p_pmns.c
>===================================================================
>--- secure-pcp.orig/src/libpcp/src/p_pmns.c	2012-07-25 16:53:17.175947801 +1000
>+++ secure-pcp/src/libpcp/src/p_pmns.c	2012-07-25 16:53:35.788036322 +1000
>@@ -494,16 +494,26 @@ static int
> DecodeNameReq(__pmPDU *pdubuf, char **name_p, int *subtype)
> {
>     namereq_t	*namereq_pdu;
>+    char	*pdu_end;
>     char	*name;
>     int		namelen;
> 
>     namereq_pdu = (namereq_t *)pdubuf;
>+    pdu_end = (char *)pdubuf + namereq_pdu->hdr.len;
>+
>+    if (pdu_end - (char *)namereq_pdu < sizeof(namereq_t) - sizeof(int))
>+	return PM_ERR_IPC;
> 
>     /* only set it if you want it */
>     if (subtype != NULL)
> 	*subtype = ntohl(namereq_pdu->subtype);
>-
>     namelen = ntohl(namereq_pdu->namelen);
>+
>+    if (namelen < 0 || namelen > namereq_pdu->hdr.len || namelen+1 >= INT_MAX)
>+	return PM_ERR_IPC;
>+    if (sizeof(namereq_t) - sizeof(int) + namelen > (size_t)(pdu_end - (char *)namereq_pdu))
>+	return PM_ERR_IPC;
>+
>     name = malloc(namelen+1);
>     if (name == NULL)
> 	return -oserror();

Actions: View | Diff

Attachments on bug 841180: 600700 | 600961