Attachment 3550 Details for Bug 20131 – патч для устранения уязвимости

[patch] патч для устранения уязвимости

ctorrent-dnh3.3.2-security-fix.patch (text/plain), 2.80 KB, created by Andrew Clark on 2009-05-21 17:43:26 MSD

(hide)

Description:

Filename:

MIME Type:

Creator: Andrew Clark

Created: 2009-05-21 17:43:26 MSD

Size: 2.80 KB

patch

obsolete

>Index: bencode.h
>===================================================================
>--- bencode.h	(revision 301)
>+++ bencode.h	(revision 302)
>@@ -25,7 +25,7 @@
> size_t decode_list(const char *b,size_t len,const char *keylist);
> size_t decode_rev(const char *b,size_t len,const char *keylist);
> size_t decode_query(const char *b,size_t len,const char *keylist,const char **ps,size_t *pi,int64_t *pl,int method);
>-size_t decode_list2path(const char *b, size_t n, char *pathname);
>+size_t decode_list2path(const char *b, size_t n, char *pathname, size_t maxlen);
> size_t bencode_buf(const char *str,size_t len,FILE *fp);
> size_t bencode_str(const char *str, FILE *fp);
> size_t bencode_int(const uint64_t integer, FILE *fp);
>Index: bencode.cpp
>===================================================================
>--- bencode.cpp	(revision 301)
>+++ bencode.cpp	(revision 302)
>@@ -233,22 +233,28 @@
>   return bencode_end_dict_list(fp);
> }
> 
>-size_t decode_list2path(const char *b, size_t n, char *pathname)
>+size_t decode_list2path(const char *b, size_t n, char *pathname, size_t maxlen)
> {
>   const char *pb = b;
>   const char *s = (char *) 0;
>+  const char *endmax = pathname + maxlen - 1;
>   size_t r,q;
> 
>   if( 'l' != *pb ) return 0;
>   pb++;
>   n--;
>   if( !n ) return 0;
>-  for(; n;){
>+  while( n && pathname < endmax ){
>     if(!(r = buf_str(pb, n, &s, &q)) ) return 0;
>+    if( q >= maxlen ) return 0;
>     memcpy(pathname, s, q);
>     pathname += q;
>-    pb += r; n -= r; 
>-    if( 'e' != *pb ){*pathname = PATH_SP, pathname++;} else break;
>+    maxlen -= q;
>+    pb += r;
>+    n -= r; 
>+    if( 'e' == *pb ) break;
>+    if( pathname >= endmax ) return 0;
>+    *pathname++ = PATH_SP;
>   }
>   *pathname = '\0';
>   return (pb - b + 1);
>Index: btfiles.cpp
>===================================================================
>--- btfiles.cpp	(revision 301)
>+++ btfiles.cpp	(revision 302)
>@@ -471,6 +471,8 @@
>     BTFILE *pbf_last = (BTFILE*) 0; 
>     BTFILE *pbf = (BTFILE*) 0;
>     size_t dl;
>+    unsigned long nfiles = 0;
>+
>     if( decode_query(metabuf,metabuf_len,"info|length",
>                     (const char**) 0,(size_t*) 0,(int64_t*) 0,QUERY_LONG) )
>       return -1;
>@@ -524,12 +526,18 @@
> #ifndef WINDOWS
>       if( !pbf ) return -1;
> #endif
>+      nfiles++;
>       pbf->bf_length = t;
>       m_total_files_length += t;
>       r = decode_query(p, dl, "path", (const char **)0, &n, (int64_t*)0,
>                        QUERY_POS);
>-      if( !r ) return -1;
>-      if(!decode_list2path(p + r, n, path)) return -1;
>+      if( !r || !decode_list2path(p + r, n, path, sizeof(path)) ){
>+        CONSOLE.Warning(1,
>+          "error, invalid path in torrent data for file %lu at offset %llu",
>+          nfiles, m_total_files_length - t);
>+        delete pbf;
>+        return -1;
>+      }
> 
>       int f_conv;
>       char *tmpfn = new char[strlen(path)*2+5];

Actions: View | Diff

Attachments on bug 20131: 3550