summaryrefslogtreecommitdiffstats
path: root/meta-networking/recipes-daemons/squid/files/0002-smblib-fix-buffer-over-read.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta-networking/recipes-daemons/squid/files/0002-smblib-fix-buffer-over-read.patch')
-rw-r--r--meta-networking/recipes-daemons/squid/files/0002-smblib-fix-buffer-over-read.patch39
1 files changed, 0 insertions, 39 deletions
diff --git a/meta-networking/recipes-daemons/squid/files/0002-smblib-fix-buffer-over-read.patch b/meta-networking/recipes-daemons/squid/files/0002-smblib-fix-buffer-over-read.patch
deleted file mode 100644
index c8f0c47bd..000000000
--- a/meta-networking/recipes-daemons/squid/files/0002-smblib-fix-buffer-over-read.patch
+++ /dev/null
@@ -1,39 +0,0 @@
1From a6b1e0fd14311587186e40d09bff5c8c3aada2e4 Mon Sep 17 00:00:00 2001
2From: Amos Jeffries <squid3@treenet.co.nz>
3Date: Sat, 25 Jul 2015 05:53:16 -0700
4Subject: [PATCH] smblib: fix buffer over-read
5
6When parsing SMB LanManager packets with invalid protocol ID and the
7default set of Squid supported protocols. It may access memory outside
8the buffer storing protocol names.
9
10smblib is only used by already deprecated helpers which are deprecated
11due to far more significant NTLM protocol issues. It will also only
12result in packets being rejected later with invalid protocol names. So
13this is a minor bug rather than a vulnerability.
14
15 Detected by Coverity Scan. Issue 1256165
16---
17Signed-off-by: Khem Raj <raj.khem@gmail.com>
18Upstream-Status: Backport
19
20 lib/smblib/smblib-util.c | 6 +++++-
21 1 file changed, 5 insertions(+), 1 deletion(-)
22
23diff --git a/lib/smblib/smblib-util.c b/lib/smblib/smblib-util.c
24index 6139ae2..e722cbb 100644
25--- a/lib/smblib/smblib-util.c
26+++ b/lib/smblib/smblib-util.c
27@@ -204,7 +204,11 @@ int SMB_Figure_Protocol(const char *dialects[], int prot_index)
28 {
29 int i;
30
31- if (dialects == SMB_Prots) { /* The jobs is easy, just index into table */
32+ // prot_index may be a value outside the table SMB_Types[]
33+ // which holds data at offsets 0 to 11
34+ int ourType = (prot_index < 0 || prot_index > 11);
35+
36+ if (ourType && dialects == SMB_Prots) { /* The jobs is easy, just index into table */
37
38 return(SMB_Types[prot_index]);
39 } else { /* Search through SMB_Prots looking for a match */