diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2015-05-22 04:45:52 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2015-05-22 20:02:18 +1000 |
| commit | 0882332616e4f0272c31cc47bf2018f9cb258a4e (patch) | |
| tree | b4121076bd70e652c3e6d3f0b230ce98ba6e5d6a | |
| parent | d7c31da4d42c115843edee2074d7d501f8804420 (diff) | |
upstream commit
Reorder EscapeChar option parsing to avoid a single-byte
out- of-bounds read. bz#2396 from Jaak Ristioja; ok dtucker@
Upstream-ID: 1dc6b5b63d1c8d9a88619da0b27ade461d79b060
| -rw-r--r-- | readconf.c | 12 |
1 files changed, 6 insertions, 6 deletions
@@ -1,4 +1,4 @@ -/* $OpenBSD: readconf.c,v 1.235 2015/05/04 06:10:48 djm Exp $ */ +/* $OpenBSD: readconf.c,v 1.236 2015/05/22 04:45:52 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -1236,13 +1236,13 @@ parse_int: arg = strdelim(&s); if (!arg || *arg == '\0') fatal("%.200s line %d: Missing argument.", filename, linenum); - if (arg[0] == '^' && arg[2] == 0 && + if (strcmp(arg, "none") == 0) + value = SSH_ESCAPECHAR_NONE; + else if (arg[1] == '\0') + value = (u_char) arg[0]; + else if (arg[0] == '^' && arg[2] == 0 && (u_char) arg[1] >= 64 && (u_char) arg[1] < 128) value = (u_char) arg[1] & 31; - else if (strlen(arg) == 1) - value = (u_char) arg[0]; - else if (strcmp(arg, "none") == 0) - value = SSH_ESCAPECHAR_NONE; else { fatal("%.200s line %d: Bad escape character.", filename, linenum); |