[openssh-commits] [openssh] 01/02: upstream: Prevent integer overflow in x11 port handling. These are

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

dtucker pushed a commit to branch master
in repository openssh.

commit 9998c93d57bf0f1df2bc93e0bc2d8112c6f8c720
Author: dtucker at openbsd.org <dtucker at openbsd.org>
AuthorDate: Thu Dec 5 06:47:00 2024 +0000

    upstream: Prevent integer overflow in x11 port handling. These are
    
    theoretically possible if the admin misconfigures X11DisplayOffset or the
    user misconfigures their own $DISPLAY, but don't happen in normal operation.
    From Suhov Roman via bz#3730, ok djm@
    
    OpenBSD-Commit-ID: e9e3860f1a19b862ccf07dc8ecbe8f1e1034f4ed
---
 channels.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/channels.c b/channels.c
index 8ebe21c4..1a95301e 100644
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.440 2024/10/13 22:20:06 djm Exp $ */
+/* $OpenBSD: channels.c,v 1.441 2024/12/05 06:47:00 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -4998,13 +4998,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
     u_int *display_numberp, int **chanids)
 {
 	Channel *nc = NULL;
-	int display_number, sock;
-	u_short port;
+	int display_number, sock, port;
 	struct addrinfo hints, *ai, *aitop;
 	char strport[NI_MAXSERV];
 	int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
 
-	if (chanids == NULL)
+	if (chanids == NULL || x11_display_offset < 0 ||
+	    x11_display_offset > UINT16_MAX - 6000 - MAX_DISPLAYS)
 		return -1;
 
 	for (display_number = x11_display_offset;
@@ -5226,7 +5226,8 @@ x11_connect_display(struct ssh *ssh)
 	 * buf now contains the host name.  But first we parse the
 	 * display number.
 	 */
-	if (sscanf(cp + 1, "%u", &display_number) != 1) {
+	if (sscanf(cp + 1, "%u", &display_number) != 1 ||
+	    display_number > UINT16_MAX - 6000) {
 		error("Could not parse display number from DISPLAY: %.100s",
 		    display);
 		return -1;

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.