diff options
author | Damien Miller <djm@mindrot.org> | 2006-07-10 22:21:02 +1000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2006-07-10 22:21:02 +1000 |
commit | 0f07707267fd3911bcf95b48125b522f9e222c64 (patch) | |
tree | ce7782a08b80f1b0f949f42205e899bea2d17288 | |
parent | 3d1a9f4d5dfed0d2607b7cb36e1608255a669a17 (diff) |
- djm@cvs.openbsd.org 2006/07/10 12:08:08
[channels.c]
fix misparsing of SOCKS 5 packets that could result in a crash;
reported by mk@ ok markus@
-rw-r--r-- | ChangeLog | 6 | ||||
-rw-r--r-- | channels.c | 9 |
2 files changed, 11 insertions, 4 deletions
@@ -92,6 +92,10 @@ [scp.c] duplicate argv at the start of main() because it gets modified later; pointed out by deraadt@ ok markus@ + - djm@cvs.openbsd.org 2006/07/10 12:08:08 + [channels.c] + fix misparsing of SOCKS 5 packets that could result in a crash; + reported by mk@ ok markus@ 20060706 - (dtucker) [configure.ac] Try AIX blibpath test in different order when @@ -4825,4 +4829,4 @@ - (djm) Trim deprecated options from INSTALL. Mention UsePAM - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu -$Id: ChangeLog,v 1.4382 2006/07/10 12:19:53 djm Exp $ +$Id: ChangeLog,v 1.4383 2006/07/10 12:21:02 djm Exp $ @@ -1,4 +1,4 @@ -/* $OpenBSD: channels.c,v 1.251 2006/07/03 17:59:32 stevesk Exp $ */ +/* $OpenBSD: channels.c,v 1.252 2006/07/10 12:08:08 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -1014,7 +1014,7 @@ channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset) } s5_req, s5_rsp; u_int16_t dest_port; u_char *p, dest_addr[255+1]; - u_int have, i, found, nmethods, addrlen, af; + u_int have, need, i, found, nmethods, addrlen, af; debug2("channel %d: decode socks5", c->self); p = buffer_ptr(&c->input); @@ -1075,7 +1075,10 @@ channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset) debug2("channel %d: bad socks5 atyp %d", c->self, s5_req.atyp); return -1; } - if (have < 4 + addrlen + 2) + need = sizeof(s5_req) + addrlen + 2; + if (s5_req.atyp == SSH_SOCKS5_DOMAIN) + need++; + if (have < need) return 0; buffer_consume(&c->input, sizeof(s5_req)); if (s5_req.atyp == SSH_SOCKS5_DOMAIN) |