tyler.durden/openssh-portable
1
0
Fork 0
mirror of https://github.com/PowerShell/openssh-portable.git synced 2025-07-28 16:24:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

- djm@cvs.openbsd.org 2014/03/03 22:22:30

Browse Source 
[session.c]
     ignore enviornment variables with embedded '=' or '\0' characters;
     spotted by Jann Horn; ok deraadt@
This commit is contained in:
Damien Miller 2014-03-04 09:35:17 +11:00
parent 2476c31b96
commit 8569eba5d7
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
20140304
- OpenBSD CVS Sync
- djm@cvs.openbsd.org 2014/03/03 22:22:30
[session.c]
ignore enviornment variables with embedded '=' or '\0' characters;
spotted by Jann Horn; ok deraadt@
20140301 20140301
- (djm) [regress/Makefile] Disable dhgex regress test; it breaks when - (djm) [regress/Makefile] Disable dhgex regress test; it breaks when
no moduli file exists at the expected location. no moduli file exists at the expected location.

9
session.c
View File

@ -978,6 +978,11 @@ child_set_env(char ***envp, u_int *envsizep, const char *name,
u_int envsize; u_int envsize;
u_int i, namelen; u_int i, namelen;
if (strchr(name, '=') != NULL) {
error("Invalid environment variable \"%.100s\"", name);
return;
}
/* /*
* If we're passed an uninitialized list, allocate a single null * If we're passed an uninitialized list, allocate a single null
* entry before continuing. * entry before continuing.
@ -2225,8 +2230,8 @@ session_env_req(Session *s)
char *name, *val; char *name, *val;
u_int name_len, val_len, i; u_int name_len, val_len, i;
name = packet_get_string(&name_len); name = packet_get_cstring(&name_len);
val = packet_get_string(&val_len); val = packet_get_cstring(&val_len);
packet_check_eom(); packet_check_eom();
/* Don't set too many environment variables */ /* Don't set too many environment variables */