Author: gordon
Date: Tue Jan 28 18:37:18 2020
New Revision: 357212
URL: https://svnweb.freebsd.org/changeset/base/357212
Log:
Fix urldecode buffer overrun.
Reported by: Duncan Overbruck
Security: CVE-2020-7450
Modified:
head/lib/libfetch/fetch.c
Modified: head/lib/libfetch/fetch.c
==============================================================================
--- head/lib/libfetch/fetch.c Tue Jan 28 18:32:19 2020 (r357211)
+++ head/lib/libfetch/fetch.c Tue Jan 28 18:37:18 2020 (r357212)
@@ -332,6 +332,8 @@ fetch_pctdecode(char *dst, const char *src, size_t dle
}
if (dlen-- > 0)
*dst++ = c;
+ else
+ return (NULL);
}
return (s);
}
@@ -381,11 +383,15 @@ fetchParseURL(const char *URL)
if (p && *p == '@') {
/* username */
q = fetch_pctdecode(u->user, URL, URL_USERLEN);
+ if (q == NULL)
+ goto ouch;
/* password */
- if (*q == ':')
+ if (*q == ':') {
q = fetch_pctdecode(u->pwd, q + 1, URL_PWDLEN);
-
+ if (q == NULL)
+ goto ouch;
+ }
p++;
} else {
p = URL;
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
