From: djm <djm@openbsd.org>
Date: Wed, 31 May 2017 00:43:04 +0000 (+0000)
Subject: fix possible OOB strlen() in SOCKS4A hostname parsing; ok markus@
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=8e832490ccdc53c3baf311efd352f84817a35a6c;p=openbsd

fix possible OOB strlen() in SOCKS4A hostname parsing; ok markus@
---

diff --git a/usr.bin/ssh/channels.c b/usr.bin/ssh/channels.c
index 339f6aa02b2..1938e515e82 100644
--- a/usr.bin/ssh/channels.c
+++ b/usr.bin/ssh/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.363 2017/05/30 14:23:52 markus Exp $ */
+/* $OpenBSD: channels.c,v 1.364 2017/05/31 00:43:04 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1065,9 +1065,11 @@ channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset)
 	buffer_get(&c->input, (char *)&s4_req.dest_addr, 4);
 	have = buffer_len(&c->input);
 	p = (char *)buffer_ptr(&c->input);
-	if (memchr(p, '\0', have) == NULL)
-		fatal("channel %d: decode socks4: user not nul terminated",
+	if (memchr(p, '\0', have) == NULL) {
+		error("channel %d: decode socks4: user not nul terminated",
 		    c->self);
+		return -1;
+	}
 	len = strlen(p);
 	debug2("channel %d: decode socks4: user %s/%d", c->self, p, len);
 	len++;					/* trailing '\0' */
@@ -1085,13 +1087,15 @@ channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset)
 	} else {				/* SOCKS4A: two strings */
 		have = buffer_len(&c->input);
 		p = (char *)buffer_ptr(&c->input);
+		if (memchr(p, '\0', have) == NULL) {
+			error("channel %d: decode socks4a: host not nul "
+			    "terminated", c->self);
+			return -1;
+		}
 		len = strlen(p);
 		debug2("channel %d: decode socks4a: host %s/%d",
 		    c->self, p, len);
 		len++;				/* trailing '\0' */
-		if (len > have)
-			fatal("channel %d: decode socks4a: len %d > have %d",
-			    c->self, len, have);
 		if (len > NI_MAXHOST) {
 			error("channel %d: hostname \"%.100s\" too long",
 			    c->self, p);