Attachment 600703 Details for Bug 841240 – Resolve issues in decoding PCP instreq PDUs

[patch] Resolve issues in decoding PCP instreq PDUs

pcp_instreq (text/plain), 1.48 KB, created by Nathan Scott on 2012-07-27 06:33:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nathan Scott

Created: 2012-07-27 06:33:34 UTC

Size: 1.48 KB

patch

obsolete

>Index: secure-pcp/src/libpcp/src/p_instance.c
>===================================================================
>--- secure-pcp.orig/src/libpcp/src/p_instance.c	2012-07-27 14:07:08.411961803 +1000
>+++ secure-pcp/src/libpcp/src/p_instance.c	2012-07-27 14:08:11.527947820 +1000
>@@ -75,22 +75,35 @@ int
> __pmDecodeInstanceReq(__pmPDU *pdubuf, __pmTimeval *when, pmInDom *indom, int *inst, char **name)
> {
>     instance_req_t	*pp;
>+    char		*pdu_end;
>+    int			namelen;
> 
>     pp = (instance_req_t *)pdubuf;
>+    pdu_end = (char *)pdubuf + pp->hdr.len;
>+
>+    if (pdu_end - (char *)pp < sizeof(instance_req_t) - sizeof(pp->name))
>+	return PM_ERR_IPC;
>+
>     when->tv_sec = ntohl(pp->when.tv_sec);
>     when->tv_usec = ntohl(pp->when.tv_usec);
>     *indom = __ntohpmInDom(pp->indom);
>     *inst = ntohl(pp->inst);
>-    pp->namelen = ntohl(pp->namelen);
>-    if (pp->namelen) {
>-	if ((*name = (char *)malloc(pp->namelen+1)) == NULL)
>+    namelen = ntohl(pp->namelen);
>+    if (namelen > 0) {
>+	if (namelen >= INT_MAX - 1 || namelen > pp->hdr.len)
>+	    return PM_ERR_IPC;
>+	if (pdu_end - (char *)pp < sizeof(instance_req_t) - sizeof(pp->name) + namelen)
>+	    return PM_ERR_IPC;
>+	if ((*name = (char *)malloc(namelen+1)) == NULL)
> 	    return -oserror();
>-	strncpy(*name, pp->name, pp->namelen);
>-	(*name)[pp->namelen] = '\0';
>+	strncpy(*name, pp->name, namelen);
>+	(*name)[namelen] = '\0';
>     }
>-    else
>+    else if (namelen < 0) {
>+	return PM_ERR_IPC;
>+    } else {
> 	*name = NULL;
>-
>+    }
>     return 0;
> }
>

Actions: View | Diff

Attachments on bug 841240: 600703 | 603365