1*4882a593SmuzhiyunFrom 0ec2b39d260e08e4c3464f6b95005821dc559c62 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: "Alan T. DeKok" <aland@freeradius.org> 3*4882a593SmuzhiyunDate: Mon, 28 Feb 2022 10:34:15 -0500 4*4882a593SmuzhiyunSubject: [PATCH] manual port of commit 5906bfa1 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunCVE: CVE-2022-41861 7*4882a593Smuzhiyun 8*4882a593SmuzhiyunUpstream-Status: Backport 9*4882a593Smuzhiyun[https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e08e4c3464f6b95005821dc559c62] 10*4882a593Smuzhiyun 11*4882a593SmuzhiyunSigned-off-by: Yi Zhao <yi.zhao@windriver.com> 12*4882a593Smuzhiyun--- 13*4882a593Smuzhiyun src/lib/filters.c | 12 +++++++++--- 14*4882a593Smuzhiyun 1 file changed, 9 insertions(+), 3 deletions(-) 15*4882a593Smuzhiyun 16*4882a593Smuzhiyundiff --git a/src/lib/filters.c b/src/lib/filters.c 17*4882a593Smuzhiyunindex 4868cd385d..3f3b63daee 100644 18*4882a593Smuzhiyun--- a/src/lib/filters.c 19*4882a593Smuzhiyun+++ b/src/lib/filters.c 20*4882a593Smuzhiyun@@ -1205,13 +1205,19 @@ void print_abinary(char *out, size_t outlen, uint8_t const *data, size_t len, in 21*4882a593Smuzhiyun } 22*4882a593Smuzhiyun } 23*4882a593Smuzhiyun } else if (filter->type == RAD_FILTER_GENERIC) { 24*4882a593Smuzhiyun- int count; 25*4882a593Smuzhiyun+ size_t count, masklen; 26*4882a593Smuzhiyun+ 27*4882a593Smuzhiyun+ masklen = ntohs(filter->u.generic.len); 28*4882a593Smuzhiyun+ if (masklen >= sizeof(filter->u.generic.mask)) { 29*4882a593Smuzhiyun+ *p = '\0'; 30*4882a593Smuzhiyun+ return; 31*4882a593Smuzhiyun+ } 32*4882a593Smuzhiyun 33*4882a593Smuzhiyun i = snprintf(p, outlen, " %u ", (unsigned int) ntohs(filter->u.generic.offset)); 34*4882a593Smuzhiyun p += i; 35*4882a593Smuzhiyun 36*4882a593Smuzhiyun /* show the mask */ 37*4882a593Smuzhiyun- for (count = 0; count < ntohs(filter->u.generic.len); count++) { 38*4882a593Smuzhiyun+ for (count = 0; count < masklen; count++) { 39*4882a593Smuzhiyun i = snprintf(p, outlen, "%02x", filter->u.generic.mask[count]); 40*4882a593Smuzhiyun p += i; 41*4882a593Smuzhiyun outlen -= i; 42*4882a593Smuzhiyun@@ -1222,7 +1228,7 @@ void print_abinary(char *out, size_t outlen, uint8_t const *data, size_t len, in 43*4882a593Smuzhiyun outlen--; 44*4882a593Smuzhiyun 45*4882a593Smuzhiyun /* show the value */ 46*4882a593Smuzhiyun- for (count = 0; count < ntohs(filter->u.generic.len); count++) { 47*4882a593Smuzhiyun+ for (count = 0; count < masklen; count++) { 48*4882a593Smuzhiyun i = snprintf(p, outlen, "%02x", filter->u.generic.value[count]); 49*4882a593Smuzhiyun p += i; 50*4882a593Smuzhiyun outlen -= i; 51*4882a593Smuzhiyun-- 52*4882a593Smuzhiyun2.25.1 53*4882a593Smuzhiyun 54