diff options
| author | rob <rob@cvs.openbsd.org> | 2018-08-03 01:51:29 +0000 |
|---|---|---|
| committer | rob <rob@cvs.openbsd.org> | 2018-08-03 01:51:29 +0000 |
| commit | f9b8d3d18d16b42b4cc0446e221ec6a5b123df33 (patch) | |
| tree | 1c190f4b212426d7e49d261a96023b484e0f6a00 /usr.bin | |
| parent | f7eba6032a0373a25ae53dc4c7e488b5002edb37 (diff) | |
Place a limit on the number of elements in a ber sequence/set. This prevents
possible stack overflow due to recursion in ber_free_elements().
ok claudio@
Diffstat (limited to 'usr.bin')
| -rw-r--r-- | usr.bin/ldap/ber.c | 13 | ||||
| -rw-r--r-- | usr.bin/ldap/ber.h | 7 |
2 files changed, 15 insertions, 5 deletions
diff --git a/usr.bin/ldap/ber.c b/usr.bin/ldap/ber.c index f2543f23bbe..2aa24b12777 100644 --- a/usr.bin/ldap/ber.c +++ b/usr.bin/ldap/ber.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ber.c,v 1.17 2018/07/31 19:38:09 rob Exp $ */ +/* $OpenBSD: ber.c,v 1.18 2018/08/03 01:51:28 rob Exp $ */ /* * Copyright (c) 2007, 2012 Reyk Floeter <reyk@openbsd.org> @@ -1156,7 +1156,7 @@ ber_read_element(struct ber *ber, struct ber_element *elm) long long val = 0; struct ber_element *next; unsigned int type; - int i, class, cstruct; + int i, class, cstruct, elements = 0; ssize_t len, r, totlen = 0; u_char c; @@ -1250,9 +1250,18 @@ ber_read_element(struct ber *ber, struct ber_element *elm) } next = elm->be_sub; while (len > 0) { + /* + * Prevent stack overflow from excessive recursion + * depth in ber_free_elements(). + */ + if (elements >= BER_MAX_SEQ_ELEMENTS) { + errno = ERANGE; + return -1; + } r = ber_read_element(ber, next); if (r == -1) return -1; + elements++; len -= r; if (len > 0 && next->be_next == NULL) { if ((next->be_next = ber_get_element(0)) == diff --git a/usr.bin/ldap/ber.h b/usr.bin/ldap/ber.h index 9c76a815179..ee20c56ba99 100644 --- a/usr.bin/ldap/ber.h +++ b/usr.bin/ldap/ber.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ber.h,v 1.5 2018/07/31 11:02:01 claudio Exp $ */ +/* $OpenBSD: ber.h,v 1.6 2018/08/03 01:51:28 rob Exp $ */ /* * Copyright (c) 2007, 2012 Reyk Floeter <reyk@openbsd.org> @@ -75,8 +75,9 @@ struct ber { #define BER_CLASS_MASK 0x3 /* common definitions */ -#define BER_MIN_OID_LEN 2 /* OBJECT */ -#define BER_MAX_OID_LEN 32 /* OBJECT */ +#define BER_MIN_OID_LEN 2 /* OBJECT */ +#define BER_MAX_OID_LEN 32 /* OBJECT */ +#define BER_MAX_SEQ_ELEMENTS USHRT_MAX /* 65535 */ struct ber_oid { u_int32_t bo_id[BER_MAX_OID_LEN + 1]; |