nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-01-10 09:58:01 +00:00
Code Issues Projects Releases Wiki Activity

Add an assortment of extra safety checks.

Browse Source 
[originally from svn r9896]
This commit is contained in:
Simon Tatham 2013-07-08 22:36:04 +00:00
parent ac8baf4cac
commit 8b6a8b617f
3 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
import.c
View File

@ -290,7 +290,7 @@ static int ssh2_read_mpint(void *data, int len, struct mpint_pos *ret)
if (len < 4) if (len < 4)
goto error; goto error;
bytes = GET_32BIT(d); bytes = GET_32BIT(d);
if (len < 4+bytes) if (bytes < 0 || len-4 < bytes)
goto error; goto error;
ret->start = d + 4; ret->start = d + 4;

4
sshdss.c
View File

@ -43,6 +43,8 @@ static void getstring(char **data, int *datalen, char **p, int *length)
if (*datalen < 4) if (*datalen < 4)
return; return;
*length = GET_32BIT(*data); *length = GET_32BIT(*data);
if (*length < 0)
return;
*datalen -= 4; *datalen -= 4;
*data += 4; *data += 4;
if (*datalen < *length) if (*datalen < *length)
@ -98,7 +100,7 @@ static void *dss_newkey(char *data, int len)
} }
#endif #endif
if (!p || memcmp(p, "ssh-dss", 7)) { if (!p || slen != 7 || memcmp(p, "ssh-dss", 7)) {
sfree(dss); sfree(dss);
return NULL; return NULL;
} }

2
sshrsa.c
View File

@ -526,6 +526,8 @@ static void getstring(char **data, int *datalen, char **p, int *length)
if (*datalen < 4) if (*datalen < 4)
return; return;
*length = GET_32BIT(*data); *length = GET_32BIT(*data);
if (*length < 0)
return;
*datalen -= 4; *datalen -= 4;
*data += 4; *data += 4;
if (*datalen < *length) if (*datalen < *length)