Hi, this patch fixes CVE-2013-0220.
https://fedorahosted.org/sssd/ticket/1781 Honza -- Jan Cholasta
>From 5b0893a10acbe56f7bf8cddc40fffde172a52b11 Mon Sep 17 00:00:00 2001 From: Jan Cholasta <[email protected]> Date: Wed, 23 Jan 2013 12:26:17 +0100 Subject: [PATCH] Check that strings do not go beyond the end of the packet body in autofs and SSH requests. This fixes CVE-2013-0220. https://fedorahosted.org/sssd/ticket/1781 --- src/responder/autofs/autofssrv_cmd.c | 6 +++--- src/responder/ssh/sshsrv_cmd.c | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/responder/autofs/autofssrv_cmd.c b/src/responder/autofs/autofssrv_cmd.c index 7443ebb..e1f3aed 100644 --- a/src/responder/autofs/autofssrv_cmd.c +++ b/src/responder/autofs/autofssrv_cmd.c @@ -940,7 +940,7 @@ sss_autofs_cmd_getautomntent(struct cli_ctx *client) SAFEALIGN_COPY_UINT32_CHECK(&namelen, body+c, blen, &c); - if (namelen == 0) { + if (namelen == 0 || namelen > blen - c) { ret = EINVAL; goto done; } @@ -1215,7 +1215,7 @@ sss_autofs_cmd_getautomntbyname(struct cli_ctx *client) /* FIXME - split out a function to get string from <len><str>\0 */ SAFEALIGN_COPY_UINT32_CHECK(&namelen, body+c, blen, &c); - if (namelen == 0) { + if (namelen == 0 || namelen > blen - c) { ret = EINVAL; goto done; } @@ -1239,7 +1239,7 @@ sss_autofs_cmd_getautomntbyname(struct cli_ctx *client) /* FIXME - split out a function to get string from <len><str>\0 */ SAFEALIGN_COPY_UINT32_CHECK(&keylen, body+c, blen, &c); - if (keylen == 0) { + if (keylen == 0 || keylen > blen - c) { ret = EINVAL; goto done; } diff --git a/src/responder/ssh/sshsrv_cmd.c b/src/responder/ssh/sshsrv_cmd.c index 1f4035e..f83c136 100644 --- a/src/responder/ssh/sshsrv_cmd.c +++ b/src/responder/ssh/sshsrv_cmd.c @@ -694,8 +694,8 @@ ssh_cmd_parse_request(struct ssh_cmd_ctx *cmd_ctx) } SAFEALIGN_COPY_UINT32_CHECK(&name_len, body+c, body_len, &c); - if (name_len == 0) { - DEBUG(SSSDBG_CRIT_FAILURE, ("Zero-length name is not valid\n")); + if (name_len == 0 || name_len > body_len - c) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid name length\n")); return EINVAL; } @@ -717,8 +717,8 @@ ssh_cmd_parse_request(struct ssh_cmd_ctx *cmd_ctx) if (flags & 1) { SAFEALIGN_COPY_UINT32_CHECK(&alias_len, body+c, body_len, &c); - if (alias_len == 0) { - DEBUG(SSSDBG_CRIT_FAILURE, ("Zero-length alias is not valid\n")); + if (alias_len == 0 || alias_len > body_len - c) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid alias length\n")); return EINVAL; } -- 1.8.1
_______________________________________________ sssd-devel mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
