diff options
| author | Jan Cholasta <jcholast@redhat.com> | 2013-01-23 12:26:17 +0100 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2013-01-23 15:24:35 +0100 |
| commit | a3d236b1c93b0294fabf1fb6e4824d7383536e73 (patch) | |
| tree | 1674acf55054ab1746f0987105bd8175923c2e09 /src/responder/ssh | |
| parent | e54cde6e089080e919bf990ba1fee885b227000c (diff) | |
| download | sssd-a3d236b1c93b0294fabf1fb6e4824d7383536e73.tar.gz sssd-a3d236b1c93b0294fabf1fb6e4824d7383536e73.tar.xz sssd-a3d236b1c93b0294fabf1fb6e4824d7383536e73.zip | |
Check that strings do not go beyond the end of the packet body in autofs and SSH requests.
This fixes CVE-2013-0220.
https://fedorahosted.org/sssd/ticket/1781
Diffstat (limited to 'src/responder/ssh')
| -rw-r--r-- | src/responder/ssh/sshsrv_cmd.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/responder/ssh/sshsrv_cmd.c b/src/responder/ssh/sshsrv_cmd.c index 687e8887e..aea9719d6 100644 --- a/src/responder/ssh/sshsrv_cmd.c +++ b/src/responder/ssh/sshsrv_cmd.c @@ -693,8 +693,8 @@ ssh_cmd_parse_request(struct ssh_cmd_ctx *cmd_ctx) } SAFEALIGN_COPY_UINT32_CHECK(&name_len, body+c, body_len, &c); - if (name_len == 0) { - DEBUG(SSSDBG_CRIT_FAILURE, ("Zero-length name is not valid\n")); + if (name_len == 0 || name_len > body_len - c) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid name length\n")); return EINVAL; } @@ -716,8 +716,8 @@ ssh_cmd_parse_request(struct ssh_cmd_ctx *cmd_ctx) if (flags & 1) { SAFEALIGN_COPY_UINT32_CHECK(&alias_len, body+c, body_len, &c); - if (alias_len == 0) { - DEBUG(SSSDBG_CRIT_FAILURE, ("Zero-length alias is not valid\n")); + if (alias_len == 0 || alias_len > body_len - c) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid alias length\n")); return EINVAL; } |