Attachment 645018 Details for Bug 871620 – CVE-2012-4562-Fix-possible-string-related-integer-ov.patch

[patch] CVE-2012-4562-Fix-possible-string-related-integer-ov.patch

0004-CVE-2012-4562-Fix-possible-string-related-integer-ov.patch (text/plain), 1.52 KB, created by Andreas Schneider on 2012-11-14 16:47:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Schneider

Created: 2012-11-14 16:47:34 UTC

Size: 1.52 KB

patch

obsolete

>From e3d9501b31a11b427afe1cc1cba5208adc2c3c39 Mon Sep 17 00:00:00 2001
>From: Xi Wang <xi.wang@gmail.com>
>Date: Fri, 25 Nov 2011 23:02:57 -0500
>Subject: [PATCH 04/13] CVE-2012-4562: Fix possible string related integer
> overflows.
>
>
>Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
>---
> src/string.c | 25 ++++++++++++++++++-------
> 1 file changed, 18 insertions(+), 7 deletions(-)
>
>diff --git a/src/string.c b/src/string.c
>index ff633ac..24be06c 100644
>--- a/src/string.c
>+++ b/src/string.c
>@@ -22,6 +22,7 @@
>  */
> 
> #include <errno.h>
>+#include <limits.h>
> #include <stdlib.h>
> #include <string.h>
> 
>@@ -52,7 +53,11 @@
> struct ssh_string_struct *ssh_string_new(size_t size) {
>   struct ssh_string_struct *str = NULL;
> 
>-  str = malloc(size + 4);
>+  if (size > UINT_MAX - sizeof(struct ssh_string_struct)) {
>+      return NULL;
>+  }
>+
>+  str = malloc(sizeof(struct ssh_string_struct) + size);
>   if (str == NULL) {
>     return NULL;
>   }
>@@ -142,16 +147,22 @@ size_t ssh_string_len(struct ssh_string_struct *s) {
> char *ssh_string_to_char(struct ssh_string_struct *s) {
> 	size_t len;
> 	char *new;
>-	if(s==NULL || s->string == NULL)
>-		return NULL;
>-  len = ntohl(s->size) + 1;
>-  new = malloc(len);
>+  if (s == NULL || s->string == NULL) {
>+    return NULL;
>+  }
> 
>+  len = ssh_string_len(s);
>+  if (len + 1 < len) {
>+    return NULL;
>+  }
>+
>+  new = malloc(len + 1);
>   if (new == NULL) {
>     return NULL;
>   }
>-  memcpy(new, s->string, len - 1);
>-  new[len - 1] = '\0';
>+  memcpy(new, s->string, len);
>+  new[len] = '\0';
>+
>   return new;
> }
> 
>-- 
>1.8.0
>

Actions: View | Diff

Attachments on bug 871620: 645002 | 645003 | 645004 | 645018