|
| 1 | +From 25833cefda24c60af913d6f2d532b5afd608b821 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Michael Catanzaro <mcatanzaro@redhat.com> |
| 3 | +Date: Thu, 19 Sep 2024 18:35:53 +0100 |
| 4 | +Subject: [PATCH] gsocks4aproxy: Fix a single byte buffer overflow in connect |
| 5 | + messages |
| 6 | + |
| 7 | +`SOCKS4_CONN_MSG_LEN` failed to account for the length of the final nul |
| 8 | +byte in the connect message, which is an addition in SOCKSv4a vs |
| 9 | +SOCKSv4. |
| 10 | + |
| 11 | +This means that the buffer for building and transmitting the connect |
| 12 | +message could be overflowed if the username and hostname are both |
| 13 | +`SOCKS4_MAX_LEN` (255) bytes long. |
| 14 | + |
| 15 | +Proxy configurations are normally statically configured, so the username |
| 16 | +is very unlikely to be near its maximum length, and hence this overflow |
| 17 | +is unlikely to be triggered in practice. |
| 18 | + |
| 19 | +(Commit message by Philip Withnall, diagnosis and fix by Michael |
| 20 | +Catanzaro.) |
| 21 | + |
| 22 | +Fixes: #3461 |
| 23 | +--- |
| 24 | + gio/gsocks4aproxy.c | 4 ++-- |
| 25 | + 1 file changed, 2 insertions(+), 2 deletions(-) |
| 26 | + |
| 27 | +diff --git a/gio/gsocks4aproxy.c b/gio/gsocks4aproxy.c |
| 28 | +index 3dad118eb7..b3146d08fd 100644 |
| 29 | +--- a/gio/gsocks4aproxy.c |
| 30 | ++++ b/gio/gsocks4aproxy.c |
| 31 | +@@ -79,9 +79,9 @@ g_socks4a_proxy_init (GSocks4aProxy *proxy) |
| 32 | + * +----+----+----+----+----+----+----+----+----+----+....+----+------+....+------+ |
| 33 | + * | VN | CD | DSTPORT | DSTIP | USERID |NULL| HOST | | NULL | |
| 34 | + * +----+----+----+----+----+----+----+----+----+----+....+----+------+....+------+ |
| 35 | +- * 1 1 2 4 variable 1 variable |
| 36 | ++ * 1 1 2 4 variable 1 variable 1 |
| 37 | + */ |
| 38 | +-#define SOCKS4_CONN_MSG_LEN (9 + SOCKS4_MAX_LEN * 2) |
| 39 | ++#define SOCKS4_CONN_MSG_LEN (10 + SOCKS4_MAX_LEN * 2) |
| 40 | + static gint |
| 41 | + set_connect_msg (guint8 *msg, |
| 42 | + const gchar *hostname, |
| 43 | +-- |
| 44 | +GitLab |
0 commit comments