tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

- djm@cvs.openbsd.org 2006/07/10 12:08:08 

[channels.c]
     fix misparsing of SOCKS 5 packets that could result in a crash;
     reported by mk@ ok markus@
This commit is contained in:
Damien Miller 2006-07-10 22:21:02 +10:00
parent 3d1a9f4d5d
commit 0f07707267
2 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -92,6 +92,10 @@
[scp.c]
duplicate argv at the start of main() because it gets modified later;
pointed out by deraadt@ ok markus@
- djm@cvs.openbsd.org 2006/07/10 12:08:08
[channels.c]
fix misparsing of SOCKS 5 packets that could result in a crash;
reported by mk@ ok markus@
20060706
- (dtucker) [configure.ac] Try AIX blibpath test in different order when
@ -4825,4 +4829,4 @@
- (djm) Trim deprecated options from INSTALL. Mention UsePAM
- (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
$Id: ChangeLog,v 1.4382 2006/07/10 12:19:53 djm Exp $
$Id: ChangeLog,v 1.4383 2006/07/10 12:21:02 djm Exp $

9
channels.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: channels.c,v 1.251 2006/07/03 17:59:32 stevesk Exp $ */
/* $OpenBSD: channels.c,v 1.252 2006/07/10 12:08:08 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -1014,7 +1014,7 @@ channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset)
} s5_req, s5_rsp;
u_int16_t dest_port;
u_char *p, dest_addr[255+1];
u_int have, i, found, nmethods, addrlen, af;
u_int have, need, i, found, nmethods, addrlen, af;
debug2("channel %d: decode socks5", c->self);
p = buffer_ptr(&c->input);
@ -1075,7 +1075,10 @@ channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset)
debug2("channel %d: bad socks5 atyp %d", c->self, s5_req.atyp);
return -1;
}
if (have < 4 + addrlen + 2)
need = sizeof(s5_req) + addrlen + 2;
if (s5_req.atyp == SSH_SOCKS5_DOMAIN)
need++;
if (have < need)
return 0;
buffer_consume(&c->input, sizeof(s5_req));
if (s5_req.atyp == SSH_SOCKS5_DOMAIN)