nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-03-22 14:39:24 -05:00
Code Issues Projects Releases Wiki Activity

Security fixes, copied from ssh.c: check string length versus packet

Browse Source 
length on incoming SSH_SMSG_*_DATA, and check CRCs on all incoming
packets.

[originally from svn r498]
This commit is contained in:
Simon Tatham 2000-06-06 10:54:41 +00:00
parent 8bce06889d
commit 49707ddf3b
1 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
scpssh.c
View File

@ -93,6 +93,7 @@ static void get_packet(void)
unsigned char buf[4]; unsigned char buf[4];
int ret; int ret;
int len, pad, biglen; int len, pad, biglen;
unsigned long realcrc, gotcrc;
next_packet: next_packet:
@ -145,6 +146,15 @@ next_packet:
pktin.type = pktin.data[pad]; pktin.type = pktin.data[pad];
pktin.body = pktin.data + pad + 1; pktin.body = pktin.data + pad + 1;
realcrc = crc32(pktin.data, biglen-4);
gotcrc = (pktin.data[biglen-4] << 24);
gotcrc |= (pktin.data[biglen-3] << 16);
gotcrc |= (pktin.data[biglen-2] << 8);
gotcrc |= (pktin.data[biglen-1] << 0);
if (gotcrc != realcrc) {
fatalbox("Incorrect CRC received on packet");
}
if (pktin.type == SSH_MSG_DEBUG) { if (pktin.type == SSH_MSG_DEBUG) {
if (verbose) { if (verbose) {
int len = GET_32BIT(pktin.body); int len = GET_32BIT(pktin.body);
@ -425,7 +435,10 @@ int ssh_recv(unsigned char *buf, int len)
return 0; return 0;
if (pktin.type == SSH_SMSG_STDOUT_DATA) { if (pktin.type == SSH_SMSG_STDOUT_DATA) {
int plen = GET_32BIT(pktin.body); int plen = GET_32BIT(pktin.body);
if (plen <= to_read) { if (plen+4 != pktin.length) {
fprintf(stderr, "Received data packet with bogus string length"
", ignoring\n");
} else if (plen <= to_read) {
memcpy(buf, pktin.body + 4, plen); memcpy(buf, pktin.body + 4, plen);
buf += plen; buf += plen;
to_read -= plen; to_read -= plen;
@ -437,7 +450,11 @@ int ssh_recv(unsigned char *buf, int len)
} }
} else if (pktin.type == SSH_SMSG_STDERR_DATA) { } else if (pktin.type == SSH_SMSG_STDERR_DATA) {
int plen = GET_32BIT(pktin.body); int plen = GET_32BIT(pktin.body);
fwrite(pktin.body + 4, plen, 1, stderr); if (plen+4 != pktin.length) {
fprintf(stderr, "Received data packet with bogus string length"
", ignoring\n");
} else
fwrite(pktin.body + 4, plen, 1, stderr);
} else if (pktin.type == SSH_MSG_DISCONNECT) { } else if (pktin.type == SSH_MSG_DISCONNECT) {
} else if (pktin.type == SSH_SMSG_SUCCESS || } else if (pktin.type == SSH_SMSG_SUCCESS ||
pktin.type == SSH_SMSG_FAILURE) { pktin.type == SSH_SMSG_FAILURE) {