From f61813eaea814b49489b3e917c6bdb850c7aeb8b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Oct 2012 11:35:20 +0200 Subject: CVE-2012-4562: Fix a possible infinite loop in buffer_reinit(). If needed is bigger than the highest power of two or a which fits in an integer we will loop forever. --- src/buffer.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) (limited to 'src/buffer.c') diff --git a/src/buffer.c b/src/buffer.c index 3de4f3e..ca12086 100644 --- a/src/buffer.c +++ b/src/buffer.c @@ -111,13 +111,18 @@ void ssh_buffer_free(struct ssh_buffer_struct *buffer) { SAFE_FREE(buffer); } -static int realloc_buffer(struct ssh_buffer_struct *buffer, int needed) { - int smallest = 1; - char *new = NULL; +static int realloc_buffer(struct ssh_buffer_struct *buffer, size_t needed) { + size_t smallest = 1; + char *new; + buffer_verify(buffer); + /* Find the smallest power of two which is greater or equal to needed */ while(smallest <= needed) { - smallest <<= 1; + if (smallest == 0) { + return -1; + } + smallest <<= 1; } needed = smallest; new = realloc(buffer->data, needed); -- cgit