Attachment 644990 Details for Bug 871614 – CVE-2012-4560-Fix-a-write-one-past-the-end-of-buf.patch

[patch] CVE-2012-4560-Fix-a-write-one-past-the-end-of-buf.patch

0006-CVE-2012-4560-Fix-a-write-one-past-the-end-of-buf.patch (text/plain), 1.08 KB, created by Andreas Schneider on 2012-11-14 16:44:24 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Schneider

Created: 2012-11-14 16:44:24 UTC

Size: 1.08 KB

patch

obsolete

>From b485463197cd220aa654e7fc34a18d68af37e6e7 Mon Sep 17 00:00:00 2001
>From: Andreas Schneider <asn@cryptomilk.org>
>Date: Fri, 5 Oct 2012 11:39:47 +0200
>Subject: [PATCH 06/13] CVE-2012-4560: Fix a write one past the end of 'buf'.
>
>
>Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
>---
> src/misc.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
>diff --git a/src/misc.c b/src/misc.c
>index 6223035..199018f 100644
>--- a/src/misc.c
>+++ b/src/misc.c
>@@ -719,7 +719,8 @@ char *ssh_path_expand_escape(ssh_session session, const char *s) {
>         if (*p != '%') {
>             buf[i] = *p;
>             i++;
>-            if (i > MAX_BUF_SIZE) {
>+            if (i >= MAX_BUF_SIZE) {
>+                free(r);
>                 return NULL;
>             }
>             buf[i] = '\0';
>@@ -771,7 +772,7 @@ char *ssh_path_expand_escape(ssh_session session, const char *s) {
>         }
> 
>         i += strlen(x);
>-        if (i > MAX_BUF_SIZE) {
>+        if (i >= MAX_BUF_SIZE) {
>             ssh_set_error(session, SSH_FATAL,
>                     "String too long");
>             free(x);
>-- 
>1.8.0
>

Actions: View | Diff

Attachments on bug 871614: 644664 | 644665 | 644666 | 644667 | 644668 | 644669 | 644988 | 644990