|
 |
306fa1 |
autofs-5.1.0 - check options length before use in parse_amd.c
|
|
|
306fa1 |
|
|
|
306fa1 |
From: Ian Kent <ikent@redhat.com>
|
|
|
306fa1 |
|
|
|
306fa1 |
Check for temporary buffer overflow before copy at several places in
|
|
|
306fa1 |
modules/parse_amd.c.
|
|
|
306fa1 |
---
|
|
|
306fa1 |
CHANGELOG | 1 +
|
|
|
306fa1 |
modules/parse_amd.c | 36 ++++++++++++++++++++++++++++++++----
|
|
|
306fa1 |
2 files changed, 33 insertions(+), 4 deletions(-)
|
|
|
306fa1 |
|
|
|
306fa1 |
--- autofs-5.0.7.orig/CHANGELOG
|
|
|
306fa1 |
+++ autofs-5.0.7/CHANGELOG
|
|
|
306fa1 |
@@ -141,6 +141,7 @@
|
|
|
306fa1 |
- check amd lex buffer len before copy.
|
|
|
306fa1 |
- add return check in ldap check_map_indirect().
|
|
|
306fa1 |
- check host macro is set before use.
|
|
|
306fa1 |
+- check options length before use in parse_amd.c.
|
|
|
306fa1 |
|
|
|
306fa1 |
25/07/2012 autofs-5.0.7
|
|
|
306fa1 |
=======================
|
|
|
306fa1 |
--- autofs-5.0.7.orig/modules/parse_amd.c
|
|
|
306fa1 |
+++ autofs-5.0.7/modules/parse_amd.c
|
|
|
306fa1 |
@@ -906,9 +906,20 @@ static int do_auto_mount(struct autofs_p
|
|
|
306fa1 |
{
|
|
|
306fa1 |
char target[PATH_MAX + 1];
|
|
|
306fa1 |
|
|
|
306fa1 |
- if (!entry->map_type)
|
|
|
306fa1 |
+ if (!entry->map_type) {
|
|
|
306fa1 |
+ if (strlen(entry->fs) > PATH_MAX) {
|
|
|
306fa1 |
+ error(ap->logopt, MODPREFIX
|
|
|
306fa1 |
+ "error: fs option length is too long");
|
|
|
306fa1 |
+ return 0;
|
|
|
306fa1 |
+ }
|
|
|
306fa1 |
strcpy(target, entry->fs);
|
|
|
306fa1 |
- else {
|
|
|
306fa1 |
+ } else {
|
|
|
306fa1 |
+ if (strlen(entry->fs) +
|
|
|
306fa1 |
+ strlen(entry->map_type) + 5 > PATH_MAX) {
|
|
|
306fa1 |
+ error(ap->logopt, MODPREFIX
|
|
|
306fa1 |
+ "error: fs + maptype options length is too long");
|
|
|
306fa1 |
+ return 0;
|
|
|
306fa1 |
+ }
|
|
|
306fa1 |
strcpy(target, entry->map_type);
|
|
|
306fa1 |
strcat(target, ",amd:");
|
|
|
306fa1 |
strcat(target, entry->fs);
|
|
|
306fa1 |
@@ -925,10 +936,21 @@ static int do_link_mount(struct autofs_p
|
|
|
306fa1 |
const char *opts = (entry->opts && *entry->opts) ? entry->opts : NULL;
|
|
|
306fa1 |
int ret;
|
|
|
306fa1 |
|
|
|
306fa1 |
- if (entry->sublink)
|
|
|
306fa1 |
+ if (entry->sublink) {
|
|
|
306fa1 |
+ if (strlen(entry->sublink) > PATH_MAX) {
|
|
|
306fa1 |
+ error(ap->logopt, MODPREFIX
|
|
|
306fa1 |
+ "error: sublink option length is too long");
|
|
|
306fa1 |
+ return 0;
|
|
|
306fa1 |
+ }
|
|
|
306fa1 |
strcpy(target, entry->sublink);
|
|
|
306fa1 |
- else
|
|
|
306fa1 |
+ } else {
|
|
|
306fa1 |
+ if (strlen(entry->fs) > PATH_MAX) {
|
|
|
306fa1 |
+ error(ap->logopt, MODPREFIX
|
|
|
306fa1 |
+ "error: fs option length is too long");
|
|
|
306fa1 |
+ return 0;
|
|
|
306fa1 |
+ }
|
|
|
306fa1 |
strcpy(target, entry->fs);
|
|
|
306fa1 |
+ }
|
|
|
306fa1 |
|
|
|
306fa1 |
if (!(flags & CONF_AUTOFS_USE_LOFS))
|
|
|
306fa1 |
goto symlink;
|
|
|
306fa1 |
@@ -1017,6 +1039,12 @@ static int do_nfs_mount(struct autofs_po
|
|
|
306fa1 |
unsigned int umount = 0;
|
|
|
306fa1 |
int ret = 0;
|
|
|
306fa1 |
|
|
|
306fa1 |
+ if (strlen(entry->rhost) + strlen(entry->rfs) + 1 > PATH_MAX) {
|
|
|
306fa1 |
+ error(ap->logopt, MODPREFIX
|
|
|
306fa1 |
+ "error: rhost + rfs options length is too long");
|
|
|
306fa1 |
+ return 0;
|
|
|
306fa1 |
+ }
|
|
|
306fa1 |
+
|
|
|
306fa1 |
strcpy(target, entry->rhost);
|
|
|
306fa1 |
strcat(target, ":");
|
|
|
306fa1 |
strcat(target, entry->rfs);
|