Author: gordon
Date: Tue Jan 28 18:42:06 2020
New Revision: 357214
URL: https://svnweb.freebsd.org/changeset/base/357214
Log:
MFC 357212.
Fix urldecode buffer overrun.
Reported by: Duncan Overbruck
Approved by: so
Security: FreeBSD-SA-20:01.libfetch
Security: CVE-2020-7450
Modified:
stable/11/lib/libfetch/fetch.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/lib/libfetch/fetch.c
==============================================================================
--- stable/11/lib/libfetch/fetch.c Tue Jan 28 18:40:55 2020
(r357213)
+++ stable/11/lib/libfetch/fetch.c Tue Jan 28 18:42:06 2020
(r357214)
@@ -328,6 +328,8 @@ fetch_pctdecode(char *dst, const char *src, size_t dle
}
if (dlen-- > 0)
*dst++ = c;
+ else
+ return (NULL);
}
return (s);
}
@@ -375,11 +377,15 @@ fetchParseURL(const char *URL)
if (p && *p == '@') {
/* username */
q = fetch_pctdecode(u->user, URL, URL_USERLEN);
+ if (q == NULL)
+ goto ouch;
/* password */
- if (*q == ':')
+ if (*q == ':') {
q = fetch_pctdecode(u->pwd, q + 1, URL_PWDLEN);
-
+ if (q == NULL)
+ goto ouch;
+ }
p++;
} else {
p = URL;
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
