generic-library/ssh2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

_libssh2_packet_add: SSH_MSG_DISCONNECT length checks

Browse Source 
Verify lengths before trying to read data.
This commit is contained in:
Daniel Stenberg 2010-11-09 14:53:44 +01:00
parent aa2fdb3e7e
commit 16f46c1cfc
1 changed files with 30 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
src/packet.c
View File

@ -408,6 +408,8 @@ packet_x11_open(LIBSSH2_SESSION * session, unsigned char *data,
* *
* The input pointer 'data' is pointing to allocated data that this function * The input pointer 'data' is pointing to allocated data that this function
* is asked to deal with so on failure OR success, it must be freed fine. * is asked to deal with so on failure OR success, it must be freed fine.
*
* This function will always be called with 'datalen' greater than zero.
*/ */
int int
_libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
@ -480,32 +482,36 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
switch (data[0]) { switch (data[0]) {
case SSH_MSG_DISCONNECT: case SSH_MSG_DISCONNECT:
{ {
char *message, *language; char *message=NULL;
int reason, message_len, language_len; char *language=NULL;
size_t message_len=0;
size_t language_len=0;
size_t reason=0; /* RFC4253 lists no valid reason for 0 */
reason = _libssh2_ntohu32(data + 1); if(datalen >= 5) {
message_len = _libssh2_ntohu32(data + 5); reason = _libssh2_ntohu32(data + 1);
/* 9 = packet_type(1) + reason(4) + message_len(4) */
message = (char *) data + 9; if(datalen >= 9) {
language_len = _libssh2_ntohu32(data + 9 + message_len); message_len = _libssh2_ntohu32(data + 5);
/*
* This is where we hack on the data a little, if(message_len < datalen-13) {
* Use the MSB of language_len to to a terminating NULL /* 9 = packet_type(1) + reason(4) + message_len(4) */
* (In all liklihood it is already) message = (char *) data + 9;
* Shift the language tag back a byte (In all likelihood
* it's zero length anyway) language_len = _libssh2_ntohu32(data + 9 + message_len);
* Store a NULL in the last byte of the packet to terminate language = (char *) data + 9 + message_len + 4;
* the language string
* With the lengths passed this isn't *REALLY* necessary, if(language_len > (datalen-13-message_len)) {
* but it's "kind" /* bad input, clear info */
*/ language = message = NULL;
message[message_len] = '\0'; language_len = message_len = 0;
language = (char *) data + 9 + message_len + 3; }
if (language_len) { }
memmove(language, language + 1, language_len); else
/* bad size, clear it */
message_len=0;
}
} }
language[language_len] = '\0';
if (session->ssh_msg_disconnect) { if (session->ssh_msg_disconnect) {
LIBSSH2_DISCONNECT(session, reason, message, LIBSSH2_DISCONNECT(session, reason, message,
message_len, language, language_len); message_len, language, language_len);