diff options
| author |   rob <rob@openbsd.org> | 2018-08-03 01:51:28 +0000 |
|---|---|---|
| committer | rob <rob@openbsd.org> | 2018-08-03 01:51:28 +0000 |
| commit | 477e6dcfe2d7469b85e3760c740ba1e301b2f016 (patch) | |
| tree | 4dd72d0f3c4eb8a74eb060189936e1fbcc89c118 /usr.sbin/ldapd | |
| parent | Add mue(4), a driver for Microchip LAN75xx/LAN78xx 10/100/1000 USB Ethernet (diff) | |
| download | wireguard-openbsd-477e6dcfe2d7469b85e3760c740ba1e301b2f016.tar.xz wireguard-openbsd-477e6dcfe2d7469b85e3760c740ba1e301b2f016.zip | |
Place a limit on the number of elements in a ber sequence/set. This prevents
possible stack overflow due to recursion in ber_free_elements().
ok claudio@
Diffstat (limited to 'usr.sbin/ldapd')
| -rw-r--r-- | usr.sbin/ldapd/ber.c | 13 | ||||
| -rw-r--r-- | usr.sbin/ldapd/ber.h | 7 |
2 files changed, 15 insertions, 5 deletions
diff --git a/usr.sbin/ldapd/ber.c b/usr.sbin/ldapd/ber.c index 08280dbeed7..2a53f6efa2a 100644 --- a/usr.sbin/ldapd/ber.c +++ b/usr.sbin/ldapd/ber.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ber.c,v 1.27 2018/07/31 19:38:09 rob Exp $ */ +/* $OpenBSD: ber.c,v 1.28 2018/08/03 01:51:28 rob Exp $ */ /* * Copyright (c) 2007, 2012 Reyk Floeter <reyk@openbsd.org> @@ -1156,7 +1156,7 @@ ber_read_element(struct ber *ber, struct ber_element *elm) long long val = 0; struct ber_element *next; unsigned int type; - int i, class, cstruct; + int i, class, cstruct, elements = 0; ssize_t len, r, totlen = 0; u_char c; @@ -1250,9 +1250,18 @@ ber_read_element(struct ber *ber, struct ber_element *elm) } next = elm->be_sub; while (len > 0) { + /* + * Prevent stack overflow from excessive recursion + * depth in ber_free_elements(). + */ + if (elements >= BER_MAX_SEQ_ELEMENTS) { + errno = ERANGE; + return -1; + } r = ber_read_element(ber, next); if (r == -1) return -1; + elements++; len -= r; if (len > 0 && next->be_next == NULL) { if ((next->be_next = ber_get_element(0)) == diff --git a/usr.sbin/ldapd/ber.h b/usr.sbin/ldapd/ber.h index d7d19631104..5e9c7aeacfa 100644 --- a/usr.sbin/ldapd/ber.h +++ b/usr.sbin/ldapd/ber.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ber.h,v 1.6 2018/07/31 11:01:00 claudio Exp $ */ +/* $OpenBSD: ber.h,v 1.7 2018/08/03 01:51:28 rob Exp $ */ /* * Copyright (c) 2007, 2012 Reyk Floeter <reyk@openbsd.org> @@ -75,8 +75,9 @@ struct ber { #define BER_CLASS_MASK 0x3 /* common definitions */ -#define BER_MIN_OID_LEN 2 /* OBJECT */ -#define BER_MAX_OID_LEN 32 /* OBJECT */ +#define BER_MIN_OID_LEN 2 /* OBJECT */ +#define BER_MAX_OID_LEN 32 /* OBJECT */ +#define BER_MAX_SEQ_ELEMENTS USHRT_MAX /* 65535 */ struct ber_oid { u_int32_t bo_id[BER_MAX_OID_LEN + 1]; |