aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMark Johnston <markj@FreeBSD.org>2020-12-01 19:36:37 +0000
committerMark Johnston <markj@FreeBSD.org>2020-12-01 19:36:37 +0000
commit9687ef88965705cdc3143122402b44792f8f5e1d (patch)
tree45754fbf3e948ae4d7d1f999f38b4448aae1f716
parentebe72bc26e7e31170d8b667b4388a24d5c7f0a0b (diff)
downloadsrc-9687ef88965705cdc3143122402b44792f8f5e1d.tar.gz
src-9687ef88965705cdc3143122402b44792f8f5e1d.zip
MFC r368248:
rtsold: Fix multiple buffer overflows Approved by: so Security: CVE-2020-25577
Notes
Notes: svn path=/stable/11/; revision=368253
-rw-r--r--usr.sbin/rtsold/rtsol.c24
1 files changed, 18 insertions, 6 deletions
diff --git a/usr.sbin/rtsold/rtsol.c b/usr.sbin/rtsold/rtsol.c
index cff283160e89..5324cce9de30 100644
--- a/usr.sbin/rtsold/rtsol.c
+++ b/usr.sbin/rtsold/rtsol.c
@@ -390,8 +390,8 @@ rtsol_input(int s)
newent_rai = 1;
}
-#define RA_OPT_NEXT_HDR(x) (struct nd_opt_hdr *)((char *)x + \
- (((struct nd_opt_hdr *)x)->nd_opt_len * 8))
+#define RA_OPT_NEXT_HDR(x) (struct nd_opt_hdr *)((char *)(x) + \
+ (((struct nd_opt_hdr *)(x))->nd_opt_len * 8))
/* Process RA options. */
warnmsg(LOG_DEBUG, __func__, "Processing RA");
raoptp = (char *)icp + sizeof(struct nd_router_advert);
@@ -403,6 +403,15 @@ rtsol_input(int s)
warnmsg(LOG_DEBUG, __func__, "ndo->nd_opt_len = %d",
ndo->nd_opt_len);
+ if (ndo->nd_opt_len == 0) {
+ warnmsg(LOG_INFO, __func__, "invalid option length 0.");
+ break;
+ }
+ if ((char *)RA_OPT_NEXT_HDR(raoptp) > (char *)icp + msglen) {
+ warnmsg(LOG_INFO, __func__, "option length overflow.");
+ break;
+ }
+
switch (ndo->nd_opt_type) {
case ND_OPT_RDNSS:
rdnss = (struct nd_opt_rdnss *)raoptp;
@@ -932,15 +941,18 @@ dname_labeldec(char *dst, size_t dlen, const char *src)
src_last = strchr(src, '\0');
dst_origin = dst;
memset(dst, '\0', dlen);
- while (src && (len = (uint8_t)(*src++) & 0x3f) &&
- (src + len) <= src_last &&
- (dst - dst_origin < (ssize_t)dlen)) {
- if (dst != dst_origin)
+ while ((len = (*src++) & 0x3f) &&
+ src + len <= src_last &&
+ len + (dst == dst_origin ? 0 : 1) < dlen) {
+ if (dst != dst_origin) {
*dst++ = '.';
+ dlen--;
+ }
warnmsg(LOG_DEBUG, __func__, "labellen = %zd", len);
memcpy(dst, src, len);
src += len;
dst += len;
+ dlen -= len;
}
*dst = '\0';