diff -r -N -U 3 socat-1.7.2.2/CHANGES socat-1.7.2.3/CHANGES
--- socat-1.7.2.2/CHANGES 2013-03-25 17:36:42.000000000 +0100
+++ socat-1.7.2.3/CHANGES 2014-01-28 18:39:01.000000000 +0100
@@ -1,4 +1,11 @@
+####################### V 1.7.2.3:
+
+security:
+ CVE-2014-0019: socats PROXY-CONNECT address was vulnerable to a buffer
+ overflow with data from command line (see socat-secadv5.txt)
+ Credits to Florian Weimer of the Red Hat Product Security Team
+
####################### V 1.7.2.2:
security:
diff -r -N -U 3 socat-1.7.2.2/VERSION socat-1.7.2.3/VERSION
--- socat-1.7.2.2/VERSION 2013-03-25 17:42:07.000000000 +0100
+++ socat-1.7.2.3/VERSION 2014-01-28 18:39:01.000000000 +0100
@@ -1 +1 @@
-"1.7.2.2"
+"1.7.2.3"
diff -r -N -U 3 socat-1.7.2.2/test.sh socat-1.7.2.3/test.sh
--- socat-1.7.2.2/test.sh 2013-03-22 07:43:41.000000000 +0100
+++ socat-1.7.2.3/test.sh 2014-01-28 18:39:01.000000000 +0100
@@ -49,6 +49,9 @@
#SOCAT_EGD="egd=/dev/egd-pool"
MISCDELAY=1
[ -z "$SOCAT" ] && SOCAT="./socat"
+if [ ! -x "$SOCAT" ]; then
+ echo "$SOCAT does not exist" >&2; exit 1;
+fi
[ -z "$PROCAN" ] && PROCAN="./procan"
[ -z "$FILAN" ] && FILAN="./filan"
opts="$opt_t $OPTS"
@@ -10876,6 +10879,56 @@
PORT=$((PORT+1))
N=$((N+1))
+
+if false; then # this overflow is not reliably reproducable
+# socat up to 2.0.0-b6 did not check the length of the PROXY-CONNECT command line paramters when copying them into the HTTP request buffer. This could lead to a buffer overflow.
+NAME=PROXY_ADDR_OVFL
+case "$TESTS" in
+*%functions%*|*%bugs%*|*%security%*|*%socket%*|*%$NAME%*)
+TEST="$NAME: proxy address parameters overflow"
+# invoke socat PROXY-CONNECT with long proxy server and target server names. If it terminates with exit code >= 128 it is vulnerable
+# However, even if vulnerable it often does not crash. Therefore we try to use a boundary check program like ElectricFence; only with its help we can tell that clean run proofs absence of vulnerability
+if ! eval $NUMCOND; then :; else
+tf="$td/test$N.stdout"
+te="$td/test$N.stderr"
+tdiff="$td/test$N.diff"
+da="test$N $(date) $RANDOM"
+EF=; for p in ef; do
+ if type ef >/dev/null 2>&1; then
+ EF="ef "; break
+ fi
+done
+CMD0="$SOCAT $opts TCP-LISTEN:$PORT,reuseaddr FILE:/dev/null"
+#CMD1="$EF $SOCAT $opts FILE:/dev/null PROXY-CONNECT:$(perl -e "print 'A' x 256"):$(perl -e "print 'A' x 256"):80"
+CMD1="$EF $SOCAT $opts FILE:/dev/null PROXY-CONNECT:localhost:$(perl -e "print 'A' x 384"):80,proxyport=$PORT"
+printf "test $F_n $TEST... " $N
+$CMD0 >/dev/null 2>"${te}0" &
+pid0=$!
+waittcp4port $PORT 1
+$CMD1 >/dev/null 2>"${te}1"
+rc1=$?
+if [ $rc1 -lt 128 ]; then
+ if [ "$EF" ]; then
+ $PRINTF "$OK\n"
+ numOK=$((numOK+1))
+ else
+ $PRINTF "$UNKNOWN $RED(install ElectricFEnce!)$NORMAL\n"
+ numCANT=$((num+1))
+ fi
+else
+ $PRINTF "$FAILED\n"
+ echo "$CMD1"
+ cat "${te}"
+ numFAIL=$((numFAIL+1))
+fi
+fi # NUMCOND
+ ;;
+esac
+PORT=$((PORT+1))
+N=$((N+1))
+fi # false
+
+
###############################################################################
# here come tests that might affect your systems integrity. Put normal tests
# before this paragraph.
diff -r -N -U 3 socat-1.7.2.2/xio-proxy.c socat-1.7.2.3/xio-proxy.c
--- socat-1.7.2.2/xio-proxy.c 2011-12-06 08:45:03.000000000 +0100
+++ socat-1.7.2.3/xio-proxy.c 2014-01-28 18:39:01.000000000 +0100
@@ -1,5 +1,5 @@
/* source: xio-proxy.c */
-/* Copyright Gerhard Rieger 2002-2011 */
+/* Copyright Gerhard Rieger */
/* Published under the GNU General Public License V.2, see file COPYING */
/* this file contains the source for opening addresses of HTTP proxy CONNECT
@@ -275,8 +275,9 @@
struct proxyvars *proxyvars,
int level) {
size_t offset;
- char request[CONNLEN];
- char buff[BUFLEN+1];
+ char request[CONNLEN]; /* HTTP connection request line */
+ int rv;
+ char buff[BUFLEN+1]; /* for receiving HTTP reply headers */
#if CONNLEN > BUFLEN
#error not enough buffer space
#endif
@@ -286,8 +287,12 @@
ssize_t sresult;
/* generate proxy request header - points to final target */
- sprintf(request, "CONNECT %s:%u HTTP/1.0\r\n",
- proxyvars->targetaddr, proxyvars->targetport);
+ rv = snprintf(request, CONNLEN, "CONNECT %s:%u HTTP/1.0\r\n",
+ proxyvars->targetaddr, proxyvars->targetport);
+ if (rv >= CONNLEN || rv < 0) {
+ Error("_xioopen_proxy_connect(): PROXY CONNECT buffer too small");
+ return -1;
+ }
/* send proxy CONNECT request (target addr+port) */
* xiosanitize(request, strlen(request), textbuff) = '\0';