d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix an off by one error when we limit append/prepend text sizes based on our

Browse Source 
internal buffer sizes.

When we 'append', assume we're appending to text.  Some MS dhcp servers will
give us a string with the length including the trailing NUL.  when we 'append
domain-name', we get something like "search x.y\000 z" in resolv.conf :(

MFC after:	1 week
Security:	A buffer overflow (by one NUL byte) was possible.
This commit is contained in:
Brian Somers 2009-06-08 21:42:30 +00:00
parent 27bfb741a0
commit 043bcc8d44
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=193765
1 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
sbin/dhclient/dhclient.c
View File

@ -1977,7 +1977,7 @@ priv_script_write_params(char *prefix, struct client_lease *lease)
len = ip->client-> len = ip->client->
config->defaults[i].len + config->defaults[i].len +
lease->options[i].len; lease->options[i].len;
if (len > sizeof(dbuf)) { if (len >= sizeof(dbuf)) {
warning("no space to %s %s", warning("no space to %s %s",
"prepend option", "prepend option",
dhcp_options[i].name); dhcp_options[i].name);
@ -1996,24 +1996,34 @@ priv_script_write_params(char *prefix, struct client_lease *lease)
dp[len] = '\0'; dp[len] = '\0';
break; break;
case ACTION_APPEND: case ACTION_APPEND:
/*
* When we append, we assume that we're
* appending to text. Some MS servers
* include a NUL byte at the end of
* the search string provided.
*/
len = ip->client-> len = ip->client->
config->defaults[i].len + config->defaults[i].len +
lease->options[i].len; lease->options[i].len;
if (len > sizeof(dbuf)) { if (len >= sizeof(dbuf)) {
warning("no space to %s %s", warning("no space to %s %s",
"append option", "append option",
dhcp_options[i].name); dhcp_options[i].name);
goto supersede; goto supersede;
} }
dp = dbuf; memcpy(dbuf,
memcpy(dp,
lease->options[i].data, lease->options[i].data,
lease->options[i].len); lease->options[i].len);
memcpy(dp + lease->options[i].len, for (dp = dbuf + lease->options[i].len;
dp > dbuf; dp--, len--)
if (dp[-1] != '\0')
break;
memcpy(dp,
ip->client-> ip->client->
config->defaults[i].data, config->defaults[i].data,
ip->client-> ip->client->
config->defaults[i].len); config->defaults[i].len);
dp = dbuf;
dp[len] = '\0'; dp[len] = '\0';
} }
} else { } else {