diff options
| author | Damien Miller <djm@cvs.openbsd.org> | 2006-07-10 12:08:09 +0000 |
|---|---|---|
| committer | Damien Miller <djm@cvs.openbsd.org> | 2006-07-10 12:08:09 +0000 |
| commit | 9fec9a93cf886e493c8161f07df3aa621653733c (patch) | |
| tree | 1e08f009ba9e5bb363135e6c0ec7986ef373261b /usr.bin/ssh | |
| parent | 519fda1846baebc76b0375211fb4d8f59cb505d7 (diff) | |
fix misparsing of SOCKS 5 packets that could result in a crash;
reported by mk@ ok markus@
Diffstat (limited to 'usr.bin/ssh')
| -rw-r--r-- | usr.bin/ssh/channels.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/usr.bin/ssh/channels.c b/usr.bin/ssh/channels.c index a2c6464bba4..32bb2e0d2f1 100644 --- a/usr.bin/ssh/channels.c +++ b/usr.bin/ssh/channels.c @@ -1,4 +1,4 @@ -/* $OpenBSD: channels.c,v 1.251 2006/07/03 17:59:32 stevesk Exp $ */ +/* $OpenBSD: channels.c,v 1.252 2006/07/10 12:08:08 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -1013,7 +1013,7 @@ channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset) } s5_req, s5_rsp; u_int16_t dest_port; u_char *p, dest_addr[255+1]; - u_int have, i, found, nmethods, addrlen, af; + u_int have, need, i, found, nmethods, addrlen, af; debug2("channel %d: decode socks5", c->self); p = buffer_ptr(&c->input); @@ -1074,7 +1074,10 @@ channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset) debug2("channel %d: bad socks5 atyp %d", c->self, s5_req.atyp); return -1; } - if (have < 4 + addrlen + 2) + need = sizeof(s5_req) + addrlen + 2; + if (s5_req.atyp == SSH_SOCKS5_DOMAIN) + need++; + if (have < need) return 0; buffer_consume(&c->input, sizeof(s5_req)); if (s5_req.atyp == SSH_SOCKS5_DOMAIN) |