Author: emaste
Date: Wed Feb 5 18:26:50 2020
New Revision: 357582
URL: https://svnweb.freebsd.org/changeset/base/357582
Log:
MFC r357212: libfetch: fix urldecode buffer overrun
Reported by: Duncan Overbruck
Security: CVE-2020-7450
Modified:
stable/10/lib/libfetch/fetch.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/lib/libfetch/fetch.c
==============================================================================
--- stable/10/lib/libfetch/fetch.c Wed Feb 5 18:24:28 2020
(r357581)
+++ stable/10/lib/libfetch/fetch.c Wed Feb 5 18:26:50 2020
(r357582)
@@ -328,6 +328,8 @@ fetch_pctdecode(char *dst, const char *src, size_t dle
}
if (dlen-- > 0)
*dst++ = c;
+ else
+ return (NULL);
}
return (s);
}
@@ -375,11 +377,15 @@ fetchParseURL(const char *URL)
if (p && *p == '@') {
/* username */
q = fetch_pctdecode(u->user, URL, URL_USERLEN);
+ if (q == NULL)
+ goto ouch;
/* password */
- if (*q == ':')
+ if (*q == ':') {
q = fetch_pctdecode(u->pwd, q + 1, URL_PWDLEN);
-
+ if (q == NULL)
+ goto ouch;
+ }
p++;
} else {
p = URL;
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
