Bug 500621 - possible buffer overflow
possible buffer overflow
Product: Fedora
Classification: Fedora
Component: nufw (Show other bugs)
All Linux
low Severity medium
: ---
: ---
Assigned To: Jerome Soyer
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2009-05-13 09:36 EDT by Jan F. Chadima
Modified: 2009-11-25 12:42 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-11-25 12:42:57 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jan F. Chadima 2009-05-13 09:36:07 EDT
Description of problem:

in src/clients/lib/internal.c is potential buffer overflow in call to sasl_encode64, where is defined output buffer length longer than output buffer.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
Actual results:

Expected results:

Additional info:

patch awailable:
diff -up nufw-2.2.21/src/clients/lib/internal.c.sasl nufw-2.2.21/src/clients/lib/internal.c                               
--- nufw-2.2.21/src/clients/lib/internal.c.sasl 2009-05-11 09:16:15.896292354 +0200                                       
+++ nufw-2.2.21/src/clients/lib/internal.c      2009-05-11 09:16:36.781306803 +0200                                       
@@ -103,7 +103,7 @@ static int samp_send(gnutls_session sess                                                              
                return 0;                                                                                                 
-       result = sasl_encode64(buffer, length, buf + 3, alloclen, &len);                                                  
+       result = sasl_encode64(buffer, length, buf + 3, alloclen - 3, &len);                                              
        if (result != SASL_OK) {                                                                                          
                SET_ERROR(err, SASL_ERROR, result);                                                                       
Comment 1 Tomas Mraz 2009-05-13 10:33:14 EDT
The overflow is of course only potential because the current sasl_encode64 implementation will never requre more that alloclen-3 bytes for the encoding. But nevertheless the code should be fixed as in the patch above.
Comment 2 Bug Zapper 2009-06-09 11:44:53 EDT
This bug appears to have been reported against 'rawhide' during the Fedora 11 development cycle.
Changing version to '11'.

More information and reason for this action is here:
Comment 3 Tomas Mraz 2009-11-25 12:42:57 EST
As the buffer overflow is not real I've just reported the problem with the patch upstream.

Note You need to log in before you can comment on or make changes to this bug.