deepblue/ipmitool
1
0
Fork 0
mirror of https://github.com/ipmitool/ipmitool.git synced 2025-05-10 10:37:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ID: 318 - ipmi_tsol.c: fix buffer overflow

Browse Source 
Commit fixes buffer over-flow in ipmi_tsol caused by mis-calculation in buffer
size, resp. using wrong variables completely.
This commit is contained in:
Zdenek Styblik 2014-05-29 20:19:37 +02:00
parent 3b15a7c0e2
commit d79b0e05af
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
lib/ipmi_tsol.c
View File

@ -372,7 +372,8 @@ ipmi_tsol_main(struct ipmi_intf *intf, int argc, char **argv)
struct sockaddr_in sin, myaddr, *sa_in; struct sockaddr_in sin, myaddr, *sa_in;
socklen_t mylen; socklen_t mylen;
char *recvip = NULL; char *recvip = NULL;
char out_buff[IPMI_BUF_SIZE * 8], in_buff[IPMI_BUF_SIZE]; char in_buff[IPMI_BUF_SIZE];
char out_buff[IPMI_BUF_SIZE * 8];
char buff[IPMI_BUF_SIZE + 4]; char buff[IPMI_BUF_SIZE + 4];
int fd_socket, result, i; int fd_socket, result, i;
int out_buff_fill, in_buff_fill; int out_buff_fill, in_buff_fill;
@ -524,7 +525,6 @@ ipmi_tsol_main(struct ipmi_intf *intf, int argc, char **argv)
out_buff_fill = 0; out_buff_fill = 0;
in_buff_fill = 0; in_buff_fill = 0;
fds = fds_wait; fds = fds_wait;
for (;;) { for (;;) {
result = poll(fds, 3, 15 * 1000); result = poll(fds, 3, 15 * 1000);
if (result < 0) { if (result < 0) {
@ -536,9 +536,15 @@ ipmi_tsol_main(struct ipmi_intf *intf, int argc, char **argv)
if ((fds[0].revents & POLLIN) && (sizeof(out_buff) > out_buff_fill)) { if ((fds[0].revents & POLLIN) && (sizeof(out_buff) > out_buff_fill)) {
socklen_t sin_len = sizeof(sin); socklen_t sin_len = sizeof(sin);
/* Note - buffer over-flow here */ int buff_size = sizeof(buff);
if ((sizeof(out_buff) - out_buff_fill + 4) < buff_size) {
buff_size = (sizeof(out_buff) - out_buff_fill) + 4;
if ((buff_size - 4) <= 0) {
buff_size = 0;
}
}
result = recvfrom(fd_socket, buff, result = recvfrom(fd_socket, buff,
sizeof(out_buff) - out_buff_fill + 4, 0, buff_size, 0,
(struct sockaddr *)&sin, &sin_len); (struct sockaddr *)&sin, &sin_len);
/* read the data from udp socket, /* read the data from udp socket,
* skip some bytes in the head * skip some bytes in the head