RepoMirrors
/
openssh
mirror of git://anongit.mindrot.org/openssh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

- (djm) Security: fix off-by-one buffer overrun in fake-getnameinfo.c. 

Report and fix from Pavel Kankovsky <peak@argo.troja.mff.cuni.cz>
This commit is contained in:
Damien Miller 2000-09-26 13:10:37 +11:00
parent b2033a41a1
commit e772b684cc
2 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -1,6 +1,8 @@
20000926 20000926
- (djm) Update X11-askpass to 1.0.2 in RPM spec file - (djm) Update X11-askpass to 1.0.2 in RPM spec file
- (djm) Define _REENTRANT - (djm) Define _REENTRANT to pickup strtok_r() on HP/UX
- (djm) Security: fix off-by-one buffer overrun in fake-getnameinfo.c.
Report and fix from Pavel Kankovsky <peak@argo.troja.mff.cuni.cz>
20000924 20000924
- (djm) Merged cleanup patch from Mark Miller <markm@swoon.net> - (djm) Merged cleanup patch from Mark Miller <markm@swoon.net>

10
fake-getnameinfo.c
View File

@ -25,15 +25,15 @@ int getnameinfo(const struct sockaddr *sa, size_t salen, char *host,
if (strlen(tmpserv) > servlen) if (strlen(tmpserv) > servlen)
return EAI_MEMORY; return EAI_MEMORY;
else else
strcpy(serv, tmpserv); strlcpy(serv, tmpserv, servlen);
} }
if (host) { if (host) {
if (flags & NI_NUMERICHOST) { if (flags & NI_NUMERICHOST) {
if (strlen(inet_ntoa(sin->sin_addr)) > hostlen) if (strlen(inet_ntoa(sin->sin_addr)) >= hostlen)
return EAI_MEMORY; return EAI_MEMORY;
strcpy(host, inet_ntoa(sin->sin_addr)); strlcpy(host, inet_ntoa(sin->sin_addr), hostlen);
return 0; return 0;
} else { } else {
hp = gethostbyaddr((char *)&sin->sin_addr, hp = gethostbyaddr((char *)&sin->sin_addr,
@ -41,10 +41,10 @@ int getnameinfo(const struct sockaddr *sa, size_t salen, char *host,
if (hp == NULL) if (hp == NULL)
return EAI_NODATA; return EAI_NODATA;
if (strlen(hp->h_name) > hostlen) if (strlen(hp->h_name) >= hostlen)
return EAI_MEMORY; return EAI_MEMORY;
strcpy(host, hp->h_name); strlcpy(host, hp->h_name, hostlen);
return 0; return 0;
} }
} }