Attachment 600961 Details for Bug 841180 – Updated patch to address PCP namereq PDU decoding issues

[patch] Updated patch to address PCP namereq PDU decoding issues

pcp_namereq (text/plain), 1.02 KB, created by Nathan Scott on 2012-07-29 01:10:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nathan Scott

Created: 2012-07-29 01:10:12 UTC

Size: 1.02 KB

patch

obsolete

>Index: pcp/src/libpcp/src/p_pmns.c
>===================================================================
>--- pcp.orig/src/libpcp/src/p_pmns.c	2012-07-27 14:39:23.383947549 +1000
>+++ pcp/src/libpcp/src/p_pmns.c	2012-07-29 10:57:47.511965849 +1000
>@@ -494,16 +494,26 @@ static int
> DecodeNameReq(__pmPDU *pdubuf, char **name_p, int *subtype)
> {
>     namereq_t	*namereq_pdu;
>+    char	*pdu_end;
>     char	*name;
>     int		namelen;
> 
>     namereq_pdu = (namereq_t *)pdubuf;
>+    pdu_end = (char *)pdubuf + namereq_pdu->hdr.len;
>+
>+    if (pdu_end - (char *)namereq_pdu < sizeof(namereq_t) - sizeof(int))
>+	return PM_ERR_IPC;
> 
>     /* only set it if you want it */
>     if (subtype != NULL)
> 	*subtype = ntohl(namereq_pdu->subtype);
>-
>     namelen = ntohl(namereq_pdu->namelen);
>+
>+    if (namelen < 0 || namelen > namereq_pdu->hdr.len)
>+	return PM_ERR_IPC;
>+    if (sizeof(namereq_t) - sizeof(int) + namelen > (size_t)(pdu_end - (char *)namereq_pdu))
>+	return PM_ERR_IPC;
>+
>     name = malloc(namelen+1);
>     if (name == NULL)
> 	return -oserror();

Actions: View | Diff

Attachments on bug 841180: 600700 | 600961