[Bug 1903] New: bindresvport_sa() does not validate non-zero struct sockaddr * port is within intended range

[bugzilla-daemon at bugzilla.mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=1903

           Summary: bindresvport_sa() does not validate non-zero struct
                    sockaddr  * port is within intended range
           Product: Portable OpenSSH
           Version: 5.8p2
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Miscellaneous
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: gs-bugzilla.mindrot.org at gluelogic.com


Created attachment 2043
  --> https://bugzilla.mindrot.org/attachment.cgi?id=2043
validate that port provided in struct sockaddr * to bindresvport_sa()
is within valid range

openbsd-compat/bindresvport.c does not validate that the port provided
in struct sockaddr * to bindresvport_sa() is within the valid range of
intended reserved ports.  If the port provided is non-zero, then that
is taken as the starting port.  For values >= IPPORT_RESERVED, it has
the effect of attempting to bind() to that port (higher than the
reserved port range) and then, if that port is in use, tries NPORTS-1
from STARTPORT.  If all ports [STARTPORT,ENDPORT) are in use, ENDPORT
is never tried.  For non-zero values < STARTPORT, there are potentially
many lower ports that are tried, and even the possibility that no ports
within the intended range are tried.  If a free port is found, the
result is bind()ing to a port < IPPORT_RESERVED, but possibly not
within the intended range of ports.

Trivial fix attached:
change 'if (port == 0)' to 'if (port < STARTPORT || port > ENDPORT)'

Cheers,
Glenn

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.