[openssh-commits] [openssh] 17/20: upstream commit

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit c04e979503e97f52b750d3b98caa6fe004ab2ab9
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Wed May 31 00:43:04 2017 +0000

    upstream commit
    
    fix possible OOB strlen() in SOCKS4A hostname parsing;
    ok markus@
    
    Upstream-ID: c67297cbeb0e5a19d81752aa18ec44d31270cd11
---
 channels.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/channels.c b/channels.c
index d118d8ff..111a2cfa 100644
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.363 2017/05/30 14:23:52 markus Exp $ */
+/* $OpenBSD: channels.c,v 1.364 2017/05/31 00:43:04 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1075,9 +1075,11 @@ channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset)
 	buffer_get(&c->input, (char *)&s4_req.dest_addr, 4);
 	have = buffer_len(&c->input);
 	p = (char *)buffer_ptr(&c->input);
-	if (memchr(p, '\0', have) == NULL)
-		fatal("channel %d: decode socks4: user not nul terminated",
+	if (memchr(p, '\0', have) == NULL) {
+		error("channel %d: decode socks4: user not nul terminated",
 		    c->self);
+		return -1;
+	}
 	len = strlen(p);
 	debug2("channel %d: decode socks4: user %s/%d", c->self, p, len);
 	len++;					/* trailing '\0' */
@@ -1095,13 +1097,15 @@ channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset)
 	} else {				/* SOCKS4A: two strings */
 		have = buffer_len(&c->input);
 		p = (char *)buffer_ptr(&c->input);
+		if (memchr(p, '\0', have) == NULL) {
+			error("channel %d: decode socks4a: host not nul "
+			    "terminated", c->self);
+			return -1;
+		}
 		len = strlen(p);
 		debug2("channel %d: decode socks4a: host %s/%d",
 		    c->self, p, len);
 		len++;				/* trailing '\0' */
-		if (len > have)
-			fatal("channel %d: decode socks4a: len %d > have %d",
-			    c->self, len, have);
 		if (len > NI_MAXHOST) {
 			error("channel %d: hostname \"%.100s\" too long",
 			    c->self, p);

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.