1*4882a593SmuzhiyunFrom 6ab007dbb1958371abff2eaaad2b26da89b3c74e Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Yi Zhao <yi.zhao@windriver.com> 3*4882a593SmuzhiyunDate: Fri, 24 Apr 2020 09:43:44 +0800 4*4882a593SmuzhiyunSubject: [PATCH] telnetd/utility.c: fix CVE-2020-10188 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunUpstream-Status: Backport 7*4882a593Smuzhiyun[Fedora: https://src.fedoraproject.org/rpms/telnet/raw/master/f/telnet-0.17-overflow-exploit.patch] 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunCVE: CVE-2020-10188 10*4882a593Smuzhiyun 11*4882a593SmuzhiyunSigned-off-by: Yi Zhao <yi.zhao@windriver.com> 12*4882a593Smuzhiyun--- 13*4882a593Smuzhiyun telnetd/utility.c | 32 +++++++++++++++++++++----------- 14*4882a593Smuzhiyun 1 file changed, 21 insertions(+), 11 deletions(-) 15*4882a593Smuzhiyun 16*4882a593Smuzhiyundiff --git a/telnetd/utility.c b/telnetd/utility.c 17*4882a593Smuzhiyunindex 75314cb..b9a46a6 100644 18*4882a593Smuzhiyun--- a/telnetd/utility.c 19*4882a593Smuzhiyun+++ b/telnetd/utility.c 20*4882a593Smuzhiyun@@ -169,31 +169,38 @@ void ptyflush(void) 21*4882a593Smuzhiyun */ 22*4882a593Smuzhiyun static 23*4882a593Smuzhiyun char * 24*4882a593Smuzhiyun-nextitem(char *current) 25*4882a593Smuzhiyun+nextitem(char *current, const char *endp) 26*4882a593Smuzhiyun { 27*4882a593Smuzhiyun+ if (current >= endp) { 28*4882a593Smuzhiyun+ return NULL; 29*4882a593Smuzhiyun+ } 30*4882a593Smuzhiyun if ((*current&0xff) != IAC) { 31*4882a593Smuzhiyun return current+1; 32*4882a593Smuzhiyun } 33*4882a593Smuzhiyun+ if (current+1 >= endp) { 34*4882a593Smuzhiyun+ return NULL; 35*4882a593Smuzhiyun+ } 36*4882a593Smuzhiyun switch (*(current+1)&0xff) { 37*4882a593Smuzhiyun case DO: 38*4882a593Smuzhiyun case DONT: 39*4882a593Smuzhiyun case WILL: 40*4882a593Smuzhiyun case WONT: 41*4882a593Smuzhiyun- return current+3; 42*4882a593Smuzhiyun+ return current+3 <= endp ? current+3 : NULL; 43*4882a593Smuzhiyun case SB: /* loop forever looking for the SE */ 44*4882a593Smuzhiyun { 45*4882a593Smuzhiyun register char *look = current+2; 46*4882a593Smuzhiyun 47*4882a593Smuzhiyun- for (;;) { 48*4882a593Smuzhiyun+ while (look < endp) { 49*4882a593Smuzhiyun if ((*look++&0xff) == IAC) { 50*4882a593Smuzhiyun- if ((*look++&0xff) == SE) { 51*4882a593Smuzhiyun+ if (look < endp && (*look++&0xff) == SE) { 52*4882a593Smuzhiyun return look; 53*4882a593Smuzhiyun } 54*4882a593Smuzhiyun } 55*4882a593Smuzhiyun } 56*4882a593Smuzhiyun+ return NULL; 57*4882a593Smuzhiyun } 58*4882a593Smuzhiyun default: 59*4882a593Smuzhiyun- return current+2; 60*4882a593Smuzhiyun+ return current+2 <= endp ? current+2 : NULL; 61*4882a593Smuzhiyun } 62*4882a593Smuzhiyun } /* end of nextitem */ 63*4882a593Smuzhiyun 64*4882a593Smuzhiyun@@ -219,7 +226,7 @@ void netclear(void) 65*4882a593Smuzhiyun register char *thisitem, *next; 66*4882a593Smuzhiyun char *good; 67*4882a593Smuzhiyun #define wewant(p) ((nfrontp > p) && ((*p&0xff) == IAC) && \ 68*4882a593Smuzhiyun- ((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL)) 69*4882a593Smuzhiyun+ (nfrontp > p+1 && (((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL)))) 70*4882a593Smuzhiyun 71*4882a593Smuzhiyun #if defined(ENCRYPT) 72*4882a593Smuzhiyun thisitem = nclearto > netobuf ? nclearto : netobuf; 73*4882a593Smuzhiyun@@ -227,7 +234,7 @@ void netclear(void) 74*4882a593Smuzhiyun thisitem = netobuf; 75*4882a593Smuzhiyun #endif 76*4882a593Smuzhiyun 77*4882a593Smuzhiyun- while ((next = nextitem(thisitem)) <= nbackp) { 78*4882a593Smuzhiyun+ while ((next = nextitem(thisitem, nbackp)) != NULL && next <= nbackp) { 79*4882a593Smuzhiyun thisitem = next; 80*4882a593Smuzhiyun } 81*4882a593Smuzhiyun 82*4882a593Smuzhiyun@@ -239,20 +246,23 @@ void netclear(void) 83*4882a593Smuzhiyun good = netobuf; /* where the good bytes go */ 84*4882a593Smuzhiyun #endif 85*4882a593Smuzhiyun 86*4882a593Smuzhiyun- while (nfrontp > thisitem) { 87*4882a593Smuzhiyun+ while (thisitem != NULL && nfrontp > thisitem) { 88*4882a593Smuzhiyun if (wewant(thisitem)) { 89*4882a593Smuzhiyun int length; 90*4882a593Smuzhiyun 91*4882a593Smuzhiyun next = thisitem; 92*4882a593Smuzhiyun do { 93*4882a593Smuzhiyun- next = nextitem(next); 94*4882a593Smuzhiyun- } while (wewant(next) && (nfrontp > next)); 95*4882a593Smuzhiyun+ next = nextitem(next, nfrontp); 96*4882a593Smuzhiyun+ } while (next != NULL && wewant(next) && (nfrontp > next)); 97*4882a593Smuzhiyun+ if (next == NULL) { 98*4882a593Smuzhiyun+ next = nfrontp; 99*4882a593Smuzhiyun+ } 100*4882a593Smuzhiyun length = next-thisitem; 101*4882a593Smuzhiyun bcopy(thisitem, good, length); 102*4882a593Smuzhiyun good += length; 103*4882a593Smuzhiyun thisitem = next; 104*4882a593Smuzhiyun } else { 105*4882a593Smuzhiyun- thisitem = nextitem(thisitem); 106*4882a593Smuzhiyun+ thisitem = nextitem(thisitem, nfrontp); 107*4882a593Smuzhiyun } 108*4882a593Smuzhiyun } 109*4882a593Smuzhiyun 110*4882a593Smuzhiyun-- 111*4882a593Smuzhiyun2.7.4 112*4882a593Smuzhiyun 113