Attachment 26347 Details for Bug 63201

[patch] New patch fixing same bugs which shoed also up in proxyd.c

imapd-security.dif (text/plain), 3.89 KB, created by Sebastian Krahmer on 2004-11-23 22:30:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2004-11-23 22:30:32 UTC

Size: 3.89 KB

patch

obsolete

>// Fixes:
>// CAN-2004-1011
>// CAN-2004-1013
>// intwrap in cmd_append() and post increment glitches
>// overflows in proxyd.c
>// missing 0-termination in global.c
>--- imapd.c.orig	2004-11-15 11:20:17.000000000 +0100
>+++ imapd.c	2004-11-23 15:18:22.000000000 +0100
>@@ -286,6 +286,11 @@
>     if (!ulen) ulen = strlen(user);
> 
>     if (config_getswitch(IMAPOPT_IMAPMAGICPLUS)) {
>+        if (ulen > MAX_MAILBOX_NAME) {
>+            sasl_seterror(conn, 0, "buffer overflow while canonicalizing");
>+            return SASL_BUFOVER;
>+        }
>+
> 	/* make a working copy of the auth[z]id */
> 	memcpy(userbuf, user, ulen);
> 	userbuf[ulen] = '\0';
>@@ -345,6 +350,11 @@
> 
> 	/* make a working copy of the authzid */
> 	if (!rlen) rlen = strlen(requested_user);
>+	if (rlen > MAX_MAILBOX_NAME) {
>+	    sasl_seterror(conn, 0, "buffer overflow while proxying");
>+	    return SASL_BUFOVER;
>+	}
>+
> 	memcpy(userbuf, requested_user, rlen);
> 	userbuf[rlen] = '\0';
> 	requested_user = userbuf;
>@@ -2349,10 +2359,13 @@
>     while (!r && c == ' ') {
> 	/* Grow the stage array, if necessary */
> 	if (numstage == numalloc) {
>+	    if (numalloc > INT_MAX/(2*sizeof(struct appendstage *)))
>+		goto done;
> 	    numalloc *= 2;
> 	    stage = xrealloc(stage, numalloc * sizeof(struct appendstage *));
> 	}
>-	curstage = stage[numstage++] = xzmalloc(sizeof(struct appendstage));
>+	curstage = stage[numstage] = xzmalloc(sizeof(struct appendstage));
>+	++numstage;
> 
> 	/* Parse flags */
> 	c = getword(imapd_in, &arg);
>@@ -2372,7 +2385,8 @@
> 			(char **) xrealloc((char *) curstage->flag, 
> 					   curstage->flagalloc * sizeof(char *));
> 		}
>-		curstage->flag[curstage->nflags++] = xstrdup(arg.s);
>+		curstage->flag[curstage->nflags] = xstrdup(arg.s);
>+		++curstage->nflags;
> 	    } while (c == ' ');
> 	    if (c != ')') {
> 		parseerr = 
>@@ -2770,10 +2784,10 @@
> 		int binsize = 0;
> 
> 		p = section = fetchatt.s + 7;
>-		if (*p == 'P') {
>+		if (!strncmp(p, "PEEK[", 5)) {
> 		    p = section += 5;
> 		}
>-		else if (*p == 'S') {
>+		else if (!strncmp(p, "SIZE[", 5)) {
> 		    p = section += 5;
> 		    binsize = 1;
> 		}
>@@ -2813,7 +2827,7 @@
> 	    else if (!strncmp(fetchatt.s, "BODY[", 5) ||
> 		     !strncmp(fetchatt.s, "BODY.PEEK[", 10)) {
> 		p = section = fetchatt.s + 5;
>-		if (*p == 'P') {
>+		if (!strncmp(p, "PEEK[", 5)) {
> 		    p = section += 5;
> 		}
> 		else {
>@@ -3154,7 +3168,7 @@
>     else if (!strncmp(data, "body[", 5) ||
> 	     !strncmp(data, "body.peek[", 10)) {
> 	p = section = data + 5;
>-	if (*p == 'p') {
>+	if (!strncmp(p, "peek[", 5)) {
> 	    p = section += 5;
> 	}
> 	else {
>@@ -3314,7 +3328,8 @@
> 		flag = (char **)xrealloc((char *)flag,
> 					 flagalloc*sizeof(char *));
> 	    }
>-	    flag[nflags++] = xstrdup(flagname.s);
>+	    flag[nflags] = xstrdup(flagname.s);
>+	    ++nflags;
> 	}
> 
> 	flagsparsed++;
>--- proxyd.c.orig	2004-11-23 14:42:37.000000000 +0100
>+++ proxyd.c	2004-11-23 15:00:56.000000000 +0100
>@@ -1032,6 +1032,10 @@
> 
>     if (config_getswitch(IMAPOPT_IMAPMAGICPLUS)) {
> 	/* make a working copy of the auth[z]id */
>+	if (ulen > MAX_MAILBOX_NAME) {
>+		sasl_seterror(conn, 0, "buffer overflow while canonicalizing");
>+		return SASL_BUFOVER;
>+	}
> 	memcpy(userbuf, user, ulen);
> 	userbuf[ulen] = '\0';
> 	user = userbuf;
>@@ -1090,6 +1094,11 @@
> 
> 	/* make a working copy of the authzid */
> 	if (!rlen) rlen = strlen(requested_user);
>+
>+	if (rlen > MAX_MAILBOX_NAME) {
>+		sasl_seterror(conn, 0, "buffer overflow while proxying");
>+		return SASL_BUFOVER;
>+	}
> 	memcpy(userbuf, requested_user, rlen);
> 	userbuf[rlen] = '\0';
> 	requested_user = userbuf;
>--- global.c.orig	2004-11-23 15:01:50.000000000 +0100
>+++ global.c	2004-11-23 15:23:53.000000000 +0100
>@@ -427,12 +427,12 @@
> 	return SASL_BADAUTH;
>     }
>     *out_ulen = strlen(canonuser);
>-    if (*out_ulen > out_max) {
>+    if (*out_ulen >= out_max) {
> 	sasl_seterror(conn, 0, "buffer overflow while canonicalizing");
> 	return SASL_BUFOVER;
>     }
>     
>-    strncpy(out, canonuser, out_max);
>+    strcpy(out, canonuser);
> 
>     return SASL_OK;
> }

Actions: View | Diff

Attachments on bug 63201: 26056 | 26089 | 26093 | 26228 | 26239 | 26240 | 26347