Fixes ssecurityplain #440
Merged
Fixes ssecurityplain #440
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Currently it proceeds only if there aren't enough data in queue and then it blocks waiting. Also the required amount to receive from network is (ulen + plen), not (ulen + plen + 2). This allowed not authenticated clients to deny service to everyone.
Setting the limit to 1024 which should be still more than enough. Unlimited ulen and plen can cause various security problems: * Overflow in `is->checkNoWait(ulen + plen)` causing it to contine when there is not enough data and then wait forever. * Overflow in `new char[plen + 1]` that would allocate zero sized array which succeeds but returns pointer that should not be written into. * Allocation failure in `new char[plen + 1]` from trying to allocate too much and crashing the whole server. All those issues can be triggered by a client before authentication.
michalsrb
force-pushed
the
fixes-ssecurityplain
branch
from
761b2aa
to
62197c8
Compare
|
I don't see where those two extra bytes are read. I see one |
|
The original code was: It was missing the negation, so I corrected it to: And I created the pull request. But then I noticed that the formula is also incorrect so I removed the + 2: Now I believe it is correct. I have modified the commit while it was waiting for pull, which is probably what caused the confusion, sorry about that. |
|
Ah. I managed to look at the diff backwards somehow. I'll blame it on it being late here. ;) |
|
This has been assigned CVE-2017-7394 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Two security fixes for SSecurityPlain.