Permalink
Browse files

fix snmp_generic:split_index_to_keys/2

The function snmp_generic:split_index_to_keys/2 handles dynamic length
RowIndex members, but fails to check that their length actually falls
within the constraints given by the MIB.

The problem becomes real for table indices having an 'OCTET STRING'
syntax, e.g. OCTET STRING(1..32) where it is possible to pass
zero-length strings or strings longer than 32 chars without any
validation failure.
  • Loading branch information...
1 parent cfea5ee commit 8f1a00e632c10372db5a0ee2e20d2e0b5291a5cd Stefan Zegenhagen committed with proxyles Jul 4, 2012
Showing with 16 additions and 4 deletions.
  1. +16 −4 lib/snmp/src/agent/snmp_generic.erl
View
20 lib/snmp/src/agent/snmp_generic.erl
@@ -640,11 +640,12 @@ collect_keys([#asn1_type{lo = X, hi = X} | _Indexes], Keys)
%% Otherwise, its a dynamic-length type => its a list
%% OBJECT IDENTIFIER, OCTET STRING or BITS (or derivatives)
%% Check if it is IMPLIED (only last element can be IMPLIED)
-collect_keys([#asn1_type{implied = true}], Keys) ->
- [Keys];
-collect_keys([_Type | Indexes], [Length | Keys]) when length(Keys) >= Length ->
+%% and also check lo/hi constraints...
+collect_keys([#asn1_type{implied = true} = Type], Keys) ->
+ [collect_check_length(Type, Keys)];
+collect_keys([Type | Indexes], [Length | Keys]) when length(Keys) >= Length ->
{StrKey, Rest} = collect_length(Length, Keys, []),
- [StrKey | collect_keys(Indexes, Rest)];
+ [collect_check_length(Type, StrKey) | collect_keys(Indexes, Rest)];
collect_keys([_Type | _Indexes], [Length | Keys]) ->
exit({error, {size_mismatch, Length, Keys}});
collect_keys([], []) -> [];
@@ -657,6 +658,17 @@ collect_length(0, Rest, Rts) ->
collect_length(N, [El | Rest], Rts) ->
collect_length(N-1, Rest, [El | Rts]).
+collect_check_length(#asn1_type{lo = Lo, hi = Hi}, ListVal) ->
+ Length = length(ListVal),
+ if
+ is_integer(Lo) andalso Length < Lo ->
+ exit({error, {size_mismatch, Lo, ListVal}});
+ is_integer(Hi) andalso Length > Hi ->
+ exit({error, {size_mismatch, Hi, ListVal}});
+ true ->
+ ListVal
+ end.
+
%%------------------------------------------------------------------
%% Checks if a certain row exists.
%% Returns true or false.

0 comments on commit 8f1a00e

Please sign in to comment.