diff options
Diffstat (limited to 'meta/recipes-support/libssh2/files/CVE-2019-17498.patch')
-rw-r--r-- | meta/recipes-support/libssh2/files/CVE-2019-17498.patch | 131 |
1 files changed, 131 insertions, 0 deletions
diff --git a/meta/recipes-support/libssh2/files/CVE-2019-17498.patch b/meta/recipes-support/libssh2/files/CVE-2019-17498.patch new file mode 100644 index 0000000000..001080072b --- /dev/null +++ b/meta/recipes-support/libssh2/files/CVE-2019-17498.patch | |||
@@ -0,0 +1,131 @@ | |||
1 | From dedcbd106f8e52d5586b0205bc7677e4c9868f9c Mon Sep 17 00:00:00 2001 | ||
2 | From: Will Cosgrove <will@panic.com> | ||
3 | Date: Fri, 30 Aug 2019 09:57:38 -0700 | ||
4 | Subject: [PATCH] packet.c: improve message parsing (#402) | ||
5 | |||
6 | * packet.c: improve parsing of packets | ||
7 | |||
8 | file: packet.c | ||
9 | |||
10 | notes: | ||
11 | Use _libssh2_get_string API in SSH_MSG_DEBUG/SSH_MSG_DISCONNECT. Additional uint32 bounds check in SSH_MSG_GLOBAL_REQUEST. | ||
12 | |||
13 | Upstream-Status: Backport | ||
14 | CVE: CVE-2019-17498 | ||
15 | Signed-off-by: Li Zhou <li.zhou@windriver.com> | ||
16 | --- | ||
17 | src/packet.c | 68 ++++++++++++++++++++++------------------------------ | ||
18 | 1 file changed, 29 insertions(+), 39 deletions(-) | ||
19 | |||
20 | diff --git a/src/packet.c b/src/packet.c | ||
21 | index 38ab629..2e01bfc 100644 | ||
22 | --- a/src/packet.c | ||
23 | +++ b/src/packet.c | ||
24 | @@ -419,8 +419,8 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, | ||
25 | size_t datalen, int macstate) | ||
26 | { | ||
27 | int rc = 0; | ||
28 | - char *message = NULL; | ||
29 | - char *language = NULL; | ||
30 | + unsigned char *message = NULL; | ||
31 | + unsigned char *language = NULL; | ||
32 | size_t message_len = 0; | ||
33 | size_t language_len = 0; | ||
34 | LIBSSH2_CHANNEL *channelp = NULL; | ||
35 | @@ -472,33 +472,23 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, | ||
36 | |||
37 | case SSH_MSG_DISCONNECT: | ||
38 | if(datalen >= 5) { | ||
39 | - size_t reason = _libssh2_ntohu32(data + 1); | ||
40 | + uint32_t reason = 0; | ||
41 | + struct string_buf buf; | ||
42 | + buf.data = (unsigned char *)data; | ||
43 | + buf.dataptr = buf.data; | ||
44 | + buf.len = datalen; | ||
45 | + buf.dataptr++; /* advance past type */ | ||
46 | |||
47 | - if(datalen >= 9) { | ||
48 | - message_len = _libssh2_ntohu32(data + 5); | ||
49 | + _libssh2_get_u32(&buf, &reason); | ||
50 | + _libssh2_get_string(&buf, &message, &message_len); | ||
51 | + _libssh2_get_string(&buf, &language, &language_len); | ||
52 | |||
53 | - if(message_len < datalen-13) { | ||
54 | - /* 9 = packet_type(1) + reason(4) + message_len(4) */ | ||
55 | - message = (char *) data + 9; | ||
56 | - | ||
57 | - language_len = | ||
58 | - _libssh2_ntohu32(data + 9 + message_len); | ||
59 | - language = (char *) data + 9 + message_len + 4; | ||
60 | - | ||
61 | - if(language_len > (datalen-13-message_len)) { | ||
62 | - /* bad input, clear info */ | ||
63 | - language = message = NULL; | ||
64 | - language_len = message_len = 0; | ||
65 | - } | ||
66 | - } | ||
67 | - else | ||
68 | - /* bad size, clear it */ | ||
69 | - message_len = 0; | ||
70 | - } | ||
71 | if(session->ssh_msg_disconnect) { | ||
72 | - LIBSSH2_DISCONNECT(session, reason, message, | ||
73 | - message_len, language, language_len); | ||
74 | + LIBSSH2_DISCONNECT(session, reason, (const char *)message, | ||
75 | + message_len, (const char *)language, | ||
76 | + language_len); | ||
77 | } | ||
78 | + | ||
79 | _libssh2_debug(session, LIBSSH2_TRACE_TRANS, | ||
80 | "Disconnect(%d): %s(%s)", reason, | ||
81 | message, language); | ||
82 | @@ -539,24 +529,24 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, | ||
83 | int always_display = data[1]; | ||
84 | |||
85 | if(datalen >= 6) { | ||
86 | - message_len = _libssh2_ntohu32(data + 2); | ||
87 | - | ||
88 | - if(message_len <= (datalen - 10)) { | ||
89 | - /* 6 = packet_type(1) + display(1) + message_len(4) */ | ||
90 | - message = (char *) data + 6; | ||
91 | - language_len = _libssh2_ntohu32(data + 6 + | ||
92 | - message_len); | ||
93 | - | ||
94 | - if(language_len <= (datalen - 10 - message_len)) | ||
95 | - language = (char *) data + 10 + message_len; | ||
96 | - } | ||
97 | + struct string_buf buf; | ||
98 | + buf.data = (unsigned char *)data; | ||
99 | + buf.dataptr = buf.data; | ||
100 | + buf.len = datalen; | ||
101 | + buf.dataptr += 2; /* advance past type & always display */ | ||
102 | + | ||
103 | + _libssh2_get_string(&buf, &message, &message_len); | ||
104 | + _libssh2_get_string(&buf, &language, &language_len); | ||
105 | } | ||
106 | |||
107 | if(session->ssh_msg_debug) { | ||
108 | - LIBSSH2_DEBUG(session, always_display, message, | ||
109 | - message_len, language, language_len); | ||
110 | + LIBSSH2_DEBUG(session, always_display, | ||
111 | + (const char *)message, | ||
112 | + message_len, (const char *)language, | ||
113 | + language_len); | ||
114 | } | ||
115 | } | ||
116 | + | ||
117 | /* | ||
118 | * _libssh2_debug will actually truncate this for us so | ||
119 | * that it's not an inordinate about of data | ||
120 | @@ -579,7 +569,7 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, | ||
121 | uint32_t len = 0; | ||
122 | unsigned char want_reply = 0; | ||
123 | len = _libssh2_ntohu32(data + 1); | ||
124 | - if(datalen >= (6 + len)) { | ||
125 | + if((len <= (UINT_MAX - 6)) && (datalen >= (6 + len))) { | ||
126 | want_reply = data[5 + len]; | ||
127 | _libssh2_debug(session, | ||
128 | LIBSSH2_TRACE_CONN, | ||
129 | -- | ||
130 | 2.17.1 | ||
131 | |||