Attachment 600701 Details for Bug 841284 – Resolve issues in decoding PCP instance PDUs

[patch] Resolve issues in decoding PCP instance PDUs

pcp_instance (text/plain), 2.22 KB, created by Nathan Scott on 2012-07-27 06:30:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nathan Scott

Created: 2012-07-27 06:30:53 UTC

Size: 2.22 KB

patch

obsolete

>Index: secure-pcp/src/libpcp/src/p_instance.c
>===================================================================
>--- secure-pcp.orig/src/libpcp/src/p_instance.c	2012-07-25 16:44:55.996047529 +1000
>+++ secure-pcp/src/libpcp/src/p_instance.c	2012-07-25 17:12:57.619948635 +1000
>@@ -181,21 +181,32 @@ __pmDecodeInstance(__pmPDU *pdubuf, __pm
>     int			j;
>     instance_t		*rp;
>     instlist_t		*ip;
>-    __pmInResult	*res = NULL;
>+    __pmInResult	*res;
>     int			sts;
>     char		*p;
>+    char		*pdu_end;
>     int			keep_instlist;
>     int			keep_namelist;
> 
>+    rp = (instance_t *)pdubuf;
>+    pdu_end = (char *)pdubuf + rp->hdr.len;
>+
>+    if (pdu_end - (char *)pdubuf < sizeof(instance_t) - sizeof(__pmPDU))
>+	return PM_ERR_IPC;
>+
>     if ((res = (__pmInResult *)malloc(sizeof(*res))) == NULL)
> 	return -oserror();
>     res->instlist = NULL;
>     res->namelist = NULL;
>-
>-    rp = (instance_t *)pdubuf;
>     res->indom = __ntohpmInDom(rp->indom);
>     res->numinst = ntohl(rp->numinst);
> 
>+    if (res->numinst >= (INT_MAX / sizeof(res->instlist[0])) ||
>+	res->numinst >= (INT_MAX / sizeof(res->namelist[0])) ||
>+	res->numinst >= rp->hdr.len) {
>+	sts = PM_ERR_IPC;
>+	goto badsts;
>+    }
>     if ((res->instlist = (int *)malloc(res->numinst * sizeof(res->instlist[0]))) == NULL) {
> 	sts = -oserror();
> 	goto badsts;
>@@ -214,16 +225,29 @@ __pmDecodeInstance(__pmPDU *pdubuf, __pm
> 
>     for (i = j = 0; i < res->numinst; i++) {
> 	ip = (instlist_t *)&rp->rest[j/sizeof(__pmPDU)];
>+	if (sizeof(instlist_t) - sizeof(sizeof(ip->name)) > (size_t)(pdu_end - (char *)ip)) {
>+	    sts = PM_ERR_IPC;
>+	    goto badsts;
>+	}
>+
> 	res->instlist[i] = ntohl(ip->inst);
> 	if (res->instlist[i] != PM_IN_NULL)
> 	    keep_instlist = 1;
> 	ip->namelen = ntohl(ip->namelen);
> 	if (ip->namelen > 0)
> 	    keep_namelist = 1;
>+	if (ip->namelen < 0 || ip->namelen >= rp->hdr.len || ip->namelen + 1 >= INT_MAX) {
>+	    sts = PM_ERR_IPC;
>+	    goto badsts;
>+	}
> 	if ((p = (char *)malloc(ip->namelen + 1)) == NULL) {
> 	    sts = -oserror();
> 	    goto badsts;
> 	}
>+	if (sizeof(instlist_t) - sizeof(int) + ip->namelen > (size_t)(pdu_end - (char *)ip)) {
>+	    sts = PM_ERR_IPC;
>+	    goto badsts;
>+	}
> 	memcpy((void *)p, (void *)ip->name, ip->namelen);
> 	p[ip->namelen] = '\0';
> 	res->namelist[i] = p;

Actions: View | Diff

Attachments on bug 841284: 600701 | 600962