[Pkg-net-snmp-commits] [pkg-net-snmp] 01/05: fix Bug#788964 snmp_pdu_parse() DoS
Hideki Yamane
henrich at moszumanska.debian.org
Fri Jan 29 23:46:16 UTC 2016
This is an automated email from the git hooks/post-receive script.
henrich pushed a commit to branch master
in repository pkg-net-snmp.
commit 41c256625c73a580beaca3b6d47bcf37cc9e437f
Author: Hideki Yamane <henrich at debian.org>
Date: Thu Jun 18 06:44:22 2015 +0900
fix Bug#788964 snmp_pdu_parse() DoS
---
debian/changelog | 7 ++
.../Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch | 128 +++++++++++++++++++++
debian/patches/series | 1 +
3 files changed, 136 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 74b1271..11a7543 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+net-snmp (5.7.3+dfsg-2) UNRELEASED; urgency=medium
+
+ * debian/patches
+ - add Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch (Closes: #788964)
+
+ -- Hideki Yamane <henrich at debian.org> Thu, 18 Jun 2015 06:43:28 +0900
+
net-snmp (5.7.3+dfsg-1) unstable; urgency=medium
* Imported Upstream version 5.7.3+dfsg
diff --git a/debian/patches/Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch b/debian/patches/Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch
new file mode 100644
index 0000000..74b3297
--- /dev/null
+++ b/debian/patches/Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch
@@ -0,0 +1,128 @@
+From: Hideki Yamane <henrich at debian.org>
+Date: Thu, 18 Jun 2015 06:21:20 +0900
+Subject: Bug#788964: net-snmp snmp_pdu_parse() DoS
+
+taken patch from https://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/
+---
+ snmplib/snmp_api.c | 55 +++++++++++++++++++++++++++---------------------------
+ 1 file changed, 28 insertions(+), 27 deletions(-)
+
+diff --git a/snmplib/snmp_api.c b/snmplib/snmp_api.c
+index d2568bf..85cc720 100644
+--- a/snmplib/snmp_api.c
++++ b/snmplib/snmp_api.c
+@@ -4350,10 +4350,9 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length)
+ u_char type;
+ u_char msg_type;
+ u_char *var_val;
+- int badtype = 0;
+ size_t len;
+ size_t four;
+- netsnmp_variable_list *vp = NULL;
++ netsnmp_variable_list *vp = NULL, *vplast = NULL;
+ oid objid[MAX_OID_LEN];
+ u_char *p;
+
+@@ -4493,38 +4492,24 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length)
+ (ASN_SEQUENCE | ASN_CONSTRUCTOR),
+ "varbinds");
+ if (data == NULL)
+- return -1;
++ goto fail;
+
+ /*
+ * get each varBind sequence
+ */
+ while ((int) *length > 0) {
+- netsnmp_variable_list *vptemp;
+- vptemp = (netsnmp_variable_list *) malloc(sizeof(*vptemp));
+- if (NULL == vptemp) {
+- return -1;
+- }
+- if (NULL == vp) {
+- pdu->variables = vptemp;
+- } else {
+- vp->next_variable = vptemp;
+- }
+- vp = vptemp;
++ vp = SNMP_MALLOC_TYPEDEF(netsnmp_variable_list);
++ if (NULL == vp)
++ goto fail;
+
+- vp->next_variable = NULL;
+- vp->val.string = NULL;
+ vp->name_length = MAX_OID_LEN;
+- vp->name = NULL;
+- vp->index = 0;
+- vp->data = NULL;
+- vp->dataFreeHook = NULL;
+ DEBUGDUMPSECTION("recv", "VarBind");
+ data = snmp_parse_var_op(data, objid, &vp->name_length, &vp->type,
+ &vp->val_len, &var_val, length);
+ if (data == NULL)
+- return -1;
++ goto fail;
+ if (snmp_set_var_objid(vp, objid, vp->name_length))
+- return -1;
++ goto fail;
+
+ len = MAX_PACKET_LENGTH;
+ DEBUGDUMPHEADER("recv", "Value");
+@@ -4604,7 +4589,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length)
+ vp->val.string = (u_char *) malloc(vp->val_len);
+ }
+ if (vp->val.string == NULL) {
+- return -1;
++ goto fail;
+ }
+ p = asn_parse_string(var_val, &len, &vp->type, vp->val.string,
+ &vp->val_len);
+@@ -4619,7 +4604,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length)
+ vp->val_len *= sizeof(oid);
+ vp->val.objid = (oid *) malloc(vp->val_len);
+ if (vp->val.objid == NULL) {
+- return -1;
++ goto fail;
+ }
+ memmove(vp->val.objid, objid, vp->val_len);
+ break;
+@@ -4631,7 +4616,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length)
+ case ASN_BIT_STR:
+ vp->val.bitstring = (u_char *) malloc(vp->val_len);
+ if (vp->val.bitstring == NULL) {
+- return -1;
++ goto fail;
+ }
+ p = asn_parse_bitstring(var_val, &len, &vp->type,
+ vp->val.bitstring, &vp->val_len);
+@@ -4640,12 +4625,28 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length)
+ break;
+ default:
+ snmp_log(LOG_ERR, "bad type returned (%x)\n", vp->type);
+- badtype = -1;
++ goto fail;
+ break;
+ }
+ DEBUGINDENTADD(-4);
++
++ if (NULL == vplast) {
++ pdu->variables = vp;
++ } else {
++ vplast->next_variable = vp;
++ }
++ vplast = vp;
++ vp = NULL;
+ }
+- return badtype;
++ return 0;
++
++ fail:
++ DEBUGMSGTL(("recv", "error while parsing VarBindList\n"));
++ /** if we were parsing a var, remove it from the pdu and free it */
++ if (vp)
++ snmp_free_var(vp);
++
++ return -1;
+ }
+
+ /*
diff --git a/debian/patches/series b/debian/patches/series
index 7f5d48d..b7ceeb5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -23,3 +23,4 @@ fix_manpage-has-errors-from-man.patch
agentx-crash.patch
Fix-kfreebsd-builds-with-kernel-headers-10.patch
fix-request-id-0.patch
+Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-net-snmp/pkg-net-snmp.git
More information about the Pkg-net-snmp-commits
mailing list