From f9b8d3d18d16b42b4cc0446e221ec6a5b123df33 Mon Sep 17 00:00:00 2001 From: rob Date: Fri, 3 Aug 2018 01:51:29 +0000 Subject: Place a limit on the number of elements in a ber sequence/set. This prevents possible stack overflow due to recursion in ber_free_elements(). ok claudio@ --- usr.sbin/ldapd/ber.c | 13 +++++++++++-- usr.sbin/ldapd/ber.h | 7 ++++--- 2 files changed, 15 insertions(+), 5 deletions(-) (limited to 'usr.sbin/ldapd') diff --git a/usr.sbin/ldapd/ber.c b/usr.sbin/ldapd/ber.c index 08280dbeed7..2a53f6efa2a 100644 --- a/usr.sbin/ldapd/ber.c +++ b/usr.sbin/ldapd/ber.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ber.c,v 1.27 2018/07/31 19:38:09 rob Exp $ */ +/* $OpenBSD: ber.c,v 1.28 2018/08/03 01:51:28 rob Exp $ */ /* * Copyright (c) 2007, 2012 Reyk Floeter @@ -1156,7 +1156,7 @@ ber_read_element(struct ber *ber, struct ber_element *elm) long long val = 0; struct ber_element *next; unsigned int type; - int i, class, cstruct; + int i, class, cstruct, elements = 0; ssize_t len, r, totlen = 0; u_char c; @@ -1250,9 +1250,18 @@ ber_read_element(struct ber *ber, struct ber_element *elm) } next = elm->be_sub; while (len > 0) { + /* + * Prevent stack overflow from excessive recursion + * depth in ber_free_elements(). + */ + if (elements >= BER_MAX_SEQ_ELEMENTS) { + errno = ERANGE; + return -1; + } r = ber_read_element(ber, next); if (r == -1) return -1; + elements++; len -= r; if (len > 0 && next->be_next == NULL) { if ((next->be_next = ber_get_element(0)) == diff --git a/usr.sbin/ldapd/ber.h b/usr.sbin/ldapd/ber.h index d7d19631104..5e9c7aeacfa 100644 --- a/usr.sbin/ldapd/ber.h +++ b/usr.sbin/ldapd/ber.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ber.h,v 1.6 2018/07/31 11:01:00 claudio Exp $ */ +/* $OpenBSD: ber.h,v 1.7 2018/08/03 01:51:28 rob Exp $ */ /* * Copyright (c) 2007, 2012 Reyk Floeter @@ -75,8 +75,9 @@ struct ber { #define BER_CLASS_MASK 0x3 /* common definitions */ -#define BER_MIN_OID_LEN 2 /* OBJECT */ -#define BER_MAX_OID_LEN 32 /* OBJECT */ +#define BER_MIN_OID_LEN 2 /* OBJECT */ +#define BER_MAX_OID_LEN 32 /* OBJECT */ +#define BER_MAX_SEQ_ELEMENTS USHRT_MAX /* 65535 */ struct ber_oid { u_int32_t bo_id[BER_MAX_OID_LEN + 1]; -- cgit v1.2.3