d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix possible buffer overflow(s) in link_ntoa(3).

Browse Source 
A specially crafted sockaddr_dl argument can trigger a static buffer overflow
in the libc library, with possibility to rewrite with arbitrary data following
static buffers that belong to other library functions.

Reviewed by:	kib
Security:	FreeBSD-SA-16:37.libc
This commit is contained in:
Gleb Smirnoff 2016-12-06 18:50:33 +00:00
parent f5c44977ff
commit 74e540d788
1 changed files with 34 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
lib/libc/net/linkaddr.c
View File

@ -35,6 +35,7 @@ __FBSDID("$FreeBSD$");
#include <sys/types.h>
#include <sys/socket.h>
#include <net/if.h>
#include <net/if_dl.h>
#include <string.h>
@ -122,31 +123,47 @@ char *
link_ntoa(const struct sockaddr_dl *sdl)
{
static char obuf[64];
char *out = obuf;
int i;
u_char *in = (u_char *)LLADDR(sdl);
u_char *inlim = in + sdl->sdl_alen;
int firsttime = 1;
_Static_assert(sizeof(obuf) >= IFNAMSIZ + 20, "obuf is too small");
char *out;
const char *in, *inlim;
int namelen, i, rem;
if (sdl->sdl_nlen) {
bcopy(sdl->sdl_data, obuf, sdl->sdl_nlen);
out += sdl->sdl_nlen;
if (sdl->sdl_alen)
namelen = (sdl->sdl_nlen <= IFNAMSIZ) ? sdl->sdl_nlen : IFNAMSIZ;
out = obuf;
rem = sizeof(obuf);
if (namelen > 0) {
bcopy(sdl->sdl_data, out, namelen);
out += namelen;
rem -= namelen;
if (sdl->sdl_alen > 0) {
*out++ = ':';
rem--;
}
}
while (in < inlim) {
if (firsttime)
firsttime = 0;
else
in = (const char *)sdl->sdl_data + sdl->sdl_nlen;
inlim = in + sdl->sdl_alen;
while (in < inlim && rem > 1) {
if (in != (const char *)sdl->sdl_data + sdl->sdl_nlen) {
*out++ = '.';
rem--;
}
i = *in++;
if (i > 0xf) {
out[1] = hexlist[i & 0xf];
if (rem < 3)
break;
*out++ = hexlist[i & 0xf];
i >>= 4;
out[0] = hexlist[i];
out += 2;
} else
*out++ = hexlist[i];
rem -= 2;
} else {
if (rem < 2)
break;
*out++ = hexlist[i];
rem++;
}
}
*out = 0;
return (obuf);