- djm@cvs.openbsd.org 2006/07/10 12:08:08

     [channels.c]
     fix misparsing of SOCKS 5 packets that could result in a crash;
     reported by mk@ ok markus@

diff --git a/ChangeLog b/ChangeLog
index 3f76aec50522b0a8d0487748b09dfe30bed04ee3..e233aa2a395f8bea91f02a8c6bb6f308ba0f3076 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -92,6 +92,10 @@
      [scp.c]
      duplicate argv at the start of main() because it gets modified later;
      pointed out by deraadt@ ok markus@
+   - djm@cvs.openbsd.org 2006/07/10 12:08:08
+     [channels.c]
+     fix misparsing of SOCKS 5 packets that could result in a crash;
+     reported by mk@ ok markus@
 
 20060706
  - (dtucker) [configure.ac] Try AIX blibpath test in different order when

diff --git a/channels.c b/channels.c
index 5796a8bb92c89b7bdc7938b673d85f4eca2c1000..cd68efded98293baa7ca776a226b0829c537c8d6 100644 (file)
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.251 2006/07/03 17:59:32 stevesk Exp $ */
+/* $OpenBSD: channels.c,v 1.252 2006/07/10 12:08:08 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1014,7 +1014,7 @@ channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset)
        } s5_req, s5_rsp;
        u_int16_t dest_port;
        u_char *p, dest_addr[255+1];
-       u_int have, i, found, nmethods, addrlen, af;
+       u_int have, need, i, found, nmethods, addrlen, af;
 
        debug2("channel %d: decode socks5", c->self);
        p = buffer_ptr(&c->input);
@@ -1075,7 +1075,10 @@ channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset)
                debug2("channel %d: bad socks5 atyp %d", c->self, s5_req.atyp);
                return -1;
        }
-       if (have < 4 + addrlen + 2)
+       need = sizeof(s5_req) + addrlen + 2;
+       if (s5_req.atyp == SSH_SOCKS5_DOMAIN)
+               need++;
+       if (have < need)
                return 0;
        buffer_consume(&c->input, sizeof(s5_req));
        if (s5_req.atyp == SSH_SOCKS5_DOMAIN)