From 2bd514cfde1938b1e245af11c9b548d58d49b325 Mon Sep 17 00:00:00 2001 From: Jan Cholasta Date: Wed, 23 Jan 2013 12:26:17 +0100 Subject: Check that strings do not go beyond the end of the packet body in autofs and SSH requests. This fixes CVE-2013-0220. https://fedorahosted.org/sssd/ticket/1781 --- src/responder/autofs/autofssrv_cmd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'src/responder/autofs') diff --git a/src/responder/autofs/autofssrv_cmd.c b/src/responder/autofs/autofssrv_cmd.c index 7443ebbf..e1f3aeda 100644 --- a/src/responder/autofs/autofssrv_cmd.c +++ b/src/responder/autofs/autofssrv_cmd.c @@ -940,7 +940,7 @@ sss_autofs_cmd_getautomntent(struct cli_ctx *client) SAFEALIGN_COPY_UINT32_CHECK(&namelen, body+c, blen, &c); - if (namelen == 0) { + if (namelen == 0 || namelen > blen - c) { ret = EINVAL; goto done; } @@ -1215,7 +1215,7 @@ sss_autofs_cmd_getautomntbyname(struct cli_ctx *client) /* FIXME - split out a function to get string from \0 */ SAFEALIGN_COPY_UINT32_CHECK(&namelen, body+c, blen, &c); - if (namelen == 0) { + if (namelen == 0 || namelen > blen - c) { ret = EINVAL; goto done; } @@ -1239,7 +1239,7 @@ sss_autofs_cmd_getautomntbyname(struct cli_ctx *client) /* FIXME - split out a function to get string from \0 */ SAFEALIGN_COPY_UINT32_CHECK(&keylen, body+c, blen, &c); - if (keylen == 0) { + if (keylen == 0 || keylen > blen - c) { ret = EINVAL; goto done; } -- cgit