Author: emaste
Date: Sun Mar 8 16:53:46 2020
New Revision: 358741
URL: https://svnweb.freebsd.org/changeset/base/358741
Log:
MFC r357212: libfetch: fix urldecode buffer overrun
Reported by: Duncan Overbruck
Security: CVE-2020-7450
Modified:
stable/9/lib/libfetch/fetch.c
Directory Properties:
stable/9/lib/libfetch/ (props changed)
Modified: stable/9/lib/libfetch/fetch.c
==============================================================================
--- stable/9/lib/libfetch/fetch.c Sun Mar 8 14:48:32 2020
(r358740)
+++ stable/9/lib/libfetch/fetch.c Sun Mar 8 16:53:46 2020
(r358741)
@@ -327,6 +327,8 @@ fetch_pctdecode(char *dst, const char *src, size_t dle
}
if (dlen-- > 0)
*dst++ = c;
+ else
+ return (NULL);
}
return (s);
}
@@ -373,11 +375,15 @@ fetchParseURL(const char *URL)
if (p && *p == '@') {
/* username */
q = fetch_pctdecode(u->user, URL, URL_USERLEN);
+ if (q == NULL)
+ goto ouch;
/* password */
- if (*q == ':')
+ if (*q == ':') {
q = fetch_pctdecode(u->pwd, q + 1, URL_PWDLEN);
-
+ if (q == NULL)
+ goto ouch;
+ }
p++;
} else {
p = URL;
_______________________________________________
svn-src-stable-9@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-9
To unsubscribe, send any mail to "svn-src-stable-9-unsubscr...@freebsd.org"
