|
 |
814382 |
From 73d49d17ce8db58e090f82719f7c9aad7340cbac Mon Sep 17 00:00:00 2001
|
|
|
814382 |
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
|
|
|
814382 |
Date: Tue, 17 Jan 2012 17:55:00 +0100
|
|
|
814382 |
Subject: [PATCH] Fix proxy response parser
|
|
|
814382 |
|
|
|
814382 |
If proxy sends overlong HTTP vesion string, the string will be copied
|
|
|
814382 |
to unallocatd space (write_buf) causing heap overflow.
|
|
|
814382 |
|
|
|
814382 |
This patch fixes it by ignoring the HTTP version string and checking
|
|
|
814382 |
the response line has been parsed correctly.
|
|
|
814382 |
|
|
|
814382 |
See <https://bugzilla.redhat.com/show_bug.cgi?id=773699> for more
|
|
|
814382 |
details.
|
|
|
814382 |
---
|
|
|
814382 |
src/client.c | 4 ++--
|
|
|
814382 |
1 files changed, 2 insertions(+), 2 deletions(-)
|
|
|
814382 |
|
|
|
814382 |
diff --git a/src/client.c b/src/client.c
|
|
|
814382 |
index d0abd41..80872be 100644
|
|
|
814382 |
--- a/src/client.c
|
|
|
814382 |
+++ b/src/client.c
|
|
|
814382 |
@@ -3878,9 +3878,9 @@ proxy_connect (root, port_number)
|
|
|
814382 |
|
|
|
814382 |
/* Wait for HTTP status code, bail out if you don't get back a 2xx code.*/
|
|
|
814382 |
count = read_line (&read_buf);
|
|
|
814382 |
- sscanf (read_buf, "%s %d", write_buf, &codenum);
|
|
|
814382 |
+ count = sscanf (read_buf, "%*s %d", &codenum);
|
|
|
814382 |
|
|
|
814382 |
- if ((codenum / 100) != 2)
|
|
|
814382 |
+ if (count != 1 || (codenum / 100) != 2)
|
|
|
814382 |
error (1, 0, "proxy server %s:%d does not support http tunnelling",
|
|
|
814382 |
root->proxy_hostname, root->proxy_port);
|
|
|
814382 |
free (read_buf);
|
|
|
814382 |
--
|
|
|
814382 |
1.7.7.5
|
|
|
814382 |
|