Attachment 600704 Details for Bug 841249 – Resolve issues in decoding PCP text PDUs

[patch] Resolve issues in decoding PCP text PDUs

pcp_text (text/plain), 1.11 KB, created by Nathan Scott on 2012-07-27 06:38:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nathan Scott

Created: 2012-07-27 06:38:22 UTC

Size: 1.11 KB

patch

obsolete

>Index: secure-pcp/src/libpcp/src/p_text.c
>===================================================================
>--- secure-pcp.orig/src/libpcp/src/p_text.c	2012-07-25 17:18:12.988036960 +1000
>+++ secure-pcp/src/libpcp/src/p_text.c	2012-07-25 17:25:35.535948903 +1000
>@@ -117,9 +117,15 @@ int
> __pmDecodeText(__pmPDU *pdubuf, int *ident, char **buffer)
> {
>     text_t	*pp;
>+    char	*pduend;
>     int		buflen;
> 
>     pp = (text_t *)pdubuf;
>+    pduend = (char *)pdubuf + pp->hdr.len;
>+
>+    if (pduend - (char*)pp < sizeof(text_t) - sizeof(int))
>+	return PM_ERR_IPC;
>+
>     /*
>      * Note: ident argument is returned in network byte order.
>      * The caller has to convert it to host byte order because
>@@ -129,6 +135,10 @@ __pmDecodeText(__pmPDU *pdubuf, int *ide
>      */
>     *ident = pp->ident;
>     buflen = ntohl(pp->buflen);
>+    if (buflen < 0 || buflen >= INT_MAX - 1 || buflen > pp->hdr.len)
>+	return PM_ERR_IPC;
>+    if (pduend - (char *)pp < sizeof(text_t) - sizeof(pp->buffer) + buflen)
>+	return PM_ERR_IPC;
>     if ((*buffer = (char *)malloc(buflen+1)) == NULL)
> 	return -oserror();
>     strncpy(*buffer, pp->buffer, buflen);

Actions: View | Diff

Attachments on bug 841249: 600704