|
 |
047f28 |
From: Antonio Torres <antorres@redhat.com>
|
|
|
047f28 |
Date: Fri, 09 Dec 2022
|
|
|
047f28 |
Subject: Fix crash on invalid abinary data
|
|
|
047f28 |
|
|
|
047f28 |
A malicious RADIUS client or home server can send a malformed abinary
|
|
|
047f28 |
attribute which can cause the server to crash.
|
|
|
047f28 |
|
|
|
047f28 |
Backport of https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e
|
|
|
047f28 |
|
|
|
047f28 |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2151706
|
|
|
047f28 |
Signed-off-by: Antonio Torres <antorres@redhat.com>
|
|
|
047f28 |
---
|
|
|
047f28 |
diff --git a/src/lib/filters.c b/src/lib/filters.c
|
|
|
047f28 |
index 4868cd385d9f..3f3b63daeef3 100644
|
|
|
047f28 |
--- a/src/lib/filters.c
|
|
|
047f28 |
+++ b/src/lib/filters.c
|
|
|
047f28 |
@@ -1205,13 +1205,19 @@ void print_abinary(char *out, size_t outlen, uint8_t const *data, size_t len, in
|
|
|
047f28 |
}
|
|
|
047f28 |
}
|
|
|
047f28 |
} else if (filter->type == RAD_FILTER_GENERIC) {
|
|
|
047f28 |
- int count;
|
|
|
047f28 |
+ size_t count, masklen;
|
|
|
047f28 |
+
|
|
|
047f28 |
+ masklen = ntohs(filter->u.generic.len);
|
|
|
047f28 |
+ if (masklen >= sizeof(filter->u.generic.mask)) {
|
|
|
047f28 |
+ *p = '\0';
|
|
|
047f28 |
+ return;
|
|
|
047f28 |
+ }
|
|
|
047f28 |
|
|
|
047f28 |
i = snprintf(p, outlen, " %u ", (unsigned int) ntohs(filter->u.generic.offset));
|
|
|
047f28 |
p += i;
|
|
|
047f28 |
|
|
|
047f28 |
/* show the mask */
|
|
|
047f28 |
- for (count = 0; count < ntohs(filter->u.generic.len); count++) {
|
|
|
047f28 |
+ for (count = 0; count < masklen; count++) {
|
|
|
047f28 |
i = snprintf(p, outlen, "%02x", filter->u.generic.mask[count]);
|
|
|
047f28 |
p += i;
|
|
|
047f28 |
outlen -= i;
|
|
|
047f28 |
@@ -1222,7 +1228,7 @@ void print_abinary(char *out, size_t outlen, uint8_t const *data, size_t len, in
|
|
|
047f28 |
outlen--;
|
|
|
047f28 |
|
|
|
047f28 |
/* show the value */
|
|
|
047f28 |
- for (count = 0; count < ntohs(filter->u.generic.len); count++) {
|
|
|
047f28 |
+ for (count = 0; count < masklen; count++) {
|
|
|
047f28 |
i = snprintf(p, outlen, "%02x", filter->u.generic.value[count]);
|
|
|
047f28 |
p += i;
|
|
|
047f28 |
outlen -= i;
|