diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2017-05-31 00:43:04 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2017-05-31 10:51:09 +1000 |
| commit | c04e979503e97f52b750d3b98caa6fe004ab2ab9 (patch) | |
| tree | 782f3862bfdc41f69c12868654dd0c0a4e4b7c6c /channels.c | |
| parent | a3bb250c93bfe556838c46ed965066afce61cffa (diff) | |
upstream commit
fix possible OOB strlen() in SOCKS4A hostname parsing;
ok markus@
Upstream-ID: c67297cbeb0e5a19d81752aa18ec44d31270cd11
Diffstat (limited to 'channels.c')
| -rw-r--r-- | channels.c | 16 |
1 files changed, 10 insertions, 6 deletions
@@ -1,4 +1,4 @@ -/* $OpenBSD: channels.c,v 1.363 2017/05/30 14:23:52 markus Exp $ */ +/* $OpenBSD: channels.c,v 1.364 2017/05/31 00:43:04 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -1075,9 +1075,11 @@ channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset) buffer_get(&c->input, (char *)&s4_req.dest_addr, 4); have = buffer_len(&c->input); p = (char *)buffer_ptr(&c->input); - if (memchr(p, '\0', have) == NULL) - fatal("channel %d: decode socks4: user not nul terminated", + if (memchr(p, '\0', have) == NULL) { + error("channel %d: decode socks4: user not nul terminated", c->self); + return -1; + } len = strlen(p); debug2("channel %d: decode socks4: user %s/%d", c->self, p, len); len++; /* trailing '\0' */ @@ -1095,13 +1097,15 @@ channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset) } else { /* SOCKS4A: two strings */ have = buffer_len(&c->input); p = (char *)buffer_ptr(&c->input); + if (memchr(p, '\0', have) == NULL) { + error("channel %d: decode socks4a: host not nul " + "terminated", c->self); + return -1; + } len = strlen(p); debug2("channel %d: decode socks4a: host %s/%d", c->self, p, len); len++; /* trailing '\0' */ - if (len > have) - fatal("channel %d: decode socks4a: len %d > have %d", - c->self, len, have); if (len > NI_MAXHOST) { error("channel %d: hostname \"%.100s\" too long", c->self, p); |