|
 |
770374 |
diff -U0 openssh-6.4p1/ChangeLog.bad-env-var openssh-6.4p1/ChangeLog
|
|
|
770374 |
--- openssh-6.4p1/ChangeLog.bad-env-var 2014-03-19 21:37:36.270509907 +0100
|
|
|
770374 |
+++ openssh-6.4p1/ChangeLog 2014-03-19 21:37:36.276509878 +0100
|
|
|
770374 |
@@ -0,0 +1,7 @@
|
|
|
770374 |
+20140304
|
|
|
770374 |
+ - OpenBSD CVS Sync
|
|
|
770374 |
+ - djm@cvs.openbsd.org 2014/03/03 22:22:30
|
|
|
770374 |
+ [session.c]
|
|
|
770374 |
+ ignore enviornment variables with embedded '=' or '\0' characters;
|
|
|
770374 |
+ spotted by Jann Horn; ok deraadt@
|
|
|
770374 |
+
|
|
|
770374 |
diff -up openssh-6.4p1/session.c.bad-env-var openssh-6.4p1/session.c
|
|
|
770374 |
--- openssh-6.4p1/session.c.bad-env-var 2014-03-19 21:37:36.233510090 +0100
|
|
|
770374 |
+++ openssh-6.4p1/session.c 2014-03-19 21:37:36.277509873 +0100
|
|
|
770374 |
@@ -990,6 +990,11 @@ child_set_env(char ***envp, u_int *envsi
|
|
|
770374 |
u_int envsize;
|
|
|
770374 |
u_int i, namelen;
|
|
|
770374 |
|
|
|
770374 |
+ if (strchr(name, '=') != NULL) {
|
|
|
770374 |
+ error("Invalid environment variable \"%.100s\"", name);
|
|
|
770374 |
+ return;
|
|
|
770374 |
+ }
|
|
|
770374 |
+
|
|
|
770374 |
/*
|
|
|
770374 |
* If we're passed an uninitialized list, allocate a single null
|
|
|
770374 |
* entry before continuing.
|
|
|
770374 |
@@ -2255,8 +2260,8 @@ session_env_req(Session *s)
|
|
|
770374 |
char *name, *val;
|
|
|
770374 |
u_int name_len, val_len, i;
|
|
|
770374 |
|
|
|
770374 |
- name = packet_get_string(&name_len);
|
|
|
770374 |
- val = packet_get_string(&val_len);
|
|
|
770374 |
+ name = packet_get_cstring(&name_len);
|
|
|
770374 |
+ val = packet_get_cstring(&val_len);
|
|
|
770374 |
packet_check_eom();
|
|
|
770374 |
|
|
|
770374 |
/* Don't set too many environment variables */
|