1*4882a593SmuzhiyunFrom 9d825e854ef53ebbe0aea2f1a69f52b763104daf Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Ariadne Conill <ariadne@dereferenced.org> 3*4882a593SmuzhiyunDate: Mon, 19 Sep 2022 14:15:12 +0200 4*4882a593SmuzhiyunSubject: [PATCH] libbb: sockaddr2str: ensure only printable characters are 5*4882a593Smuzhiyun returned for the hostname part 6*4882a593Smuzhiyun 7*4882a593SmuzhiyunCVE: CVE-2022-28391 8*4882a593SmuzhiyunSigned-off-by: Ariadne Conill <ariadne@dereferenced.org> 9*4882a593SmuzhiyunTested-by: Radoslav Kolev <radoslav.kolev@suse.com> 10*4882a593SmuzhiyunBackport from ML: http://lists.busybox.net/pipermail/busybox/2022-July/089796.html 11*4882a593SmuzhiyunSigned-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com> 12*4882a593Smuzhiyun--- 13*4882a593Smuzhiyun libbb/xconnect.c | 5 +++-- 14*4882a593Smuzhiyun 1 file changed, 3 insertions(+), 2 deletions(-) 15*4882a593Smuzhiyun 16*4882a593Smuzhiyundiff --git a/libbb/xconnect.c b/libbb/xconnect.c 17*4882a593Smuzhiyunindex 0e0b247b8..02c061e67 100644 18*4882a593Smuzhiyun--- a/libbb/xconnect.c 19*4882a593Smuzhiyun+++ b/libbb/xconnect.c 20*4882a593Smuzhiyun@@ -497,8 +497,9 @@ static char* FAST_FUNC sockaddr2str(const struct sockaddr *sa, int flags) 21*4882a593Smuzhiyun ); 22*4882a593Smuzhiyun if (rc) 23*4882a593Smuzhiyun return NULL; 24*4882a593Smuzhiyun+ /* ensure host contains only printable characters */ 25*4882a593Smuzhiyun if (flags & IGNORE_PORT) 26*4882a593Smuzhiyun- return xstrdup(host); 27*4882a593Smuzhiyun+ return xstrdup(printable_string(host)); 28*4882a593Smuzhiyun #if ENABLE_FEATURE_IPV6 29*4882a593Smuzhiyun if (sa->sa_family == AF_INET6) { 30*4882a593Smuzhiyun if (strchr(host, ':')) /* heh, it's not a resolved hostname */ 31*4882a593Smuzhiyun@@ -509,7 +510,7 @@ static char* FAST_FUNC sockaddr2str(const struct sockaddr *sa, int flags) 32*4882a593Smuzhiyun #endif 33*4882a593Smuzhiyun /* For now we don't support anything else, so it has to be INET */ 34*4882a593Smuzhiyun /*if (sa->sa_family == AF_INET)*/ 35*4882a593Smuzhiyun- return xasprintf("%s:%s", host, serv); 36*4882a593Smuzhiyun+ return xasprintf("%s:%s", printable_string(host), serv); 37*4882a593Smuzhiyun /*return xstrdup(host);*/ 38*4882a593Smuzhiyun } 39*4882a593Smuzhiyun 40*4882a593Smuzhiyun-- 41*4882a593Smuzhiyun2.37.3 42*4882a593Smuzhiyun 43