← Back to branch summary

~ubuntu-branches/debian/stretch/dropbear/stretch

« back to all changes in this revision

Viewing changes to debian/diff/0004-cve-2013-4421.diff

  • Committer: Package Import Robot
  • Author(s): Gerrit Pape, Matt Johnston, Gerrit Pape
  • Date: 2013-10-25 15:00:48 UTC
  • mfrom: (1.4.6)
  • Revision ID: package-import@ubuntu.com-20131025150048-3jq765x96xayk392
Tags: 2013.60-1
http://bugs.debian.org/692653
[ Matt Johnston ]
* New upstream release.

[ Gerrit Pape ]
* debian/diff/0004-cve-2013-4421.diff, 0005-user-disclosure.diff:
  remove; fixed upstream.
* debian/dropbear.postinst: don't fail if initramfs-tools it not
  installed (closes: #692653).

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/diff/0004-cve-2013-4421.diff
1
 
 
2
 
# HG changeset patch
3
 
# User Matt Johnston <matt@ucc.asn.au>
4
 
# Date 1368026594 -28800
5
 
# Node ID 0bf76f54de6fc6dda70985a51ee7b25922e6fea4
6
 
# Parent  7bd88d546627ff31d0e2d91e6022b3e77a943efb
7
 
Limit decompressed size
8
 
 
9
 
diff -r 7bd88d546627 -r 0bf76f54de6f packet.c
10
 
--- a/packet.c  Mon Apr 29 23:42:37 2013 +0800
11
 
+++ b/packet.c  Wed May 08 23:23:14 2013 +0800
12
 
@@ -42,7 +42,7 @@
13
 
 static int checkmac();
14
 
 
15
 
 #define ZLIB_COMPRESS_INCR 100
16
 
-#define ZLIB_DECOMPRESS_INCR 100
17
 
+#define ZLIB_DECOMPRESS_INCR 1024
18
 
 #ifndef DISABLE_ZLIB
19
 
 static buffer* buf_decompress(buffer* buf, unsigned int len);
20
 
 static void buf_compress(buffer * dest, buffer * src, unsigned int len);
21
 
@@ -420,7 +420,12 @@
22
 
                }
23
 
 
24
 
                if (zstream->avail_out == 0) {
25
 
-                       buf_resize(ret, ret->size + ZLIB_DECOMPRESS_INCR);
26
 
+                       int new_size = 0;
27
 
+                       if (ret->size >= RECV_MAX_PAYLOAD_LEN) {
28
 
+                               dropbear_exit("bad packet, oversized decompressed");
29
 
+                       }
30
 
+                       new_size = MIN(RECV_MAX_PAYLOAD_LEN, ret->size + ZLIB_DECOMPRESS_INCR);
31
 
+                       buf_resize(ret, new_size);
32
 
                }
33
 
        }
34
 
 }
35