Attachment 658700 Details for Bug 884601 – Proposed patch by Jan Cholasta

[patch] Proposed patch by Jan Cholasta

0001-Check-that-strings-do-not-go-beyond-the-end-of-the-p.patch (text/plain), 2.52 KB, created by Jan Lieskovsky on 2012-12-06 11:32:00 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan Lieskovsky

Created: 2012-12-06 11:32:00 UTC

Size: 2.52 KB

patch

obsolete

>From 4ddd91aade78d5f25450b84ac13235e65f530d24 Mon Sep 17 00:00:00 2001
>From: Jan Cholasta <jcholast@redhat.com>
>Date: Thu, 6 Dec 2012 09:29:57 +0100
>Subject: [PATCH] Check that strings do not go beyond the end of the packet
> body in autofs and SSH requests
>
>---
> src/responder/autofs/autofssrv_cmd.c | 6 +++---
> src/responder/ssh/sshsrv_cmd.c       | 8 ++++----
> 2 files changed, 7 insertions(+), 7 deletions(-)
>
>diff --git a/src/responder/autofs/autofssrv_cmd.c b/src/responder/autofs/autofssrv_cmd.c
>index 3af4a84..b40676a 100644
>--- a/src/responder/autofs/autofssrv_cmd.c
>+++ b/src/responder/autofs/autofssrv_cmd.c
>@@ -859,7 +859,7 @@ sss_autofs_cmd_getautomntent(struct cli_ctx *client)
> 
>     SAFEALIGN_COPY_UINT32_CHECK(&namelen, body+c, blen, &c);
> 
>-    if (namelen == 0) {
>+    if (namelen == 0 || namelen > blen - c) {
>         ret = EINVAL;
>         goto done;
>     }
>@@ -1134,7 +1134,7 @@ sss_autofs_cmd_getautomntbyname(struct cli_ctx *client)
>     /* FIXME - split out a function to get string from <len><str>\0 */
>     SAFEALIGN_COPY_UINT32_CHECK(&namelen, body+c, blen, &c);
> 
>-    if (namelen == 0) {
>+    if (namelen == 0 || namelen > blen -c) {
>         ret = EINVAL;
>         goto done;
>     }
>@@ -1158,7 +1158,7 @@ sss_autofs_cmd_getautomntbyname(struct cli_ctx *client)
>     /* FIXME - split out a function to get string from <len><str>\0 */
>     SAFEALIGN_COPY_UINT32_CHECK(&keylen, body+c, blen, &c);
> 
>-    if (keylen == 0) {
>+    if (keylen == 0 || keylen > blen - c) {
>         ret = EINVAL;
>         goto done;
>     }
>diff --git a/src/responder/ssh/sshsrv_cmd.c b/src/responder/ssh/sshsrv_cmd.c
>index 7de523f..3afa884 100644
>--- a/src/responder/ssh/sshsrv_cmd.c
>+++ b/src/responder/ssh/sshsrv_cmd.c
>@@ -688,8 +688,8 @@ ssh_cmd_parse_request(struct ssh_cmd_ctx *cmd_ctx)
>     }
> 
>     SAFEALIGN_COPY_UINT32_CHECK(&name_len, body+c, body_len, &c);
>-    if (name_len == 0) {
>-        DEBUG(SSSDBG_CRIT_FAILURE, ("Zero-length name is not valid\n"));
>+    if (name_len == 0 || name_len > body_len - c) {
>+        DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid name length\n"));
>         return EINVAL;
>     }
> 
>@@ -711,8 +711,8 @@ ssh_cmd_parse_request(struct ssh_cmd_ctx *cmd_ctx)
> 
>     if (flags & 1) {
>         SAFEALIGN_COPY_UINT32_CHECK(&alias_len, body+c, body_len, &c);
>-        if (alias_len == 0) {
>-            DEBUG(SSSDBG_CRIT_FAILURE, ("Zero-length alias is not valid\n"));
>+        if (alias_len == 0 || alias_len > body_len - c) {
>+            DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid alias length\n"));
>             return EINVAL;
>         }
> 
>-- 
>1.8.0.1

Actions: View | Diff

Attachments on bug 884601: 658700