Blame SOURCES/autofs-5.1.0-check-options-length-before-use-in-parse_amd_c.patch

6bbd11
autofs-5.1.0 - check options length before use in parse_amd.c
6bbd11
6bbd11
From: Ian Kent <ikent@redhat.com>
6bbd11
6bbd11
Check for temporary buffer overflow before copy at several places in
6bbd11
modules/parse_amd.c.
6bbd11
---
6bbd11
 CHANGELOG           |    1 +
6bbd11
 modules/parse_amd.c |   36 ++++++++++++++++++++++++++++++++----
6bbd11
 2 files changed, 33 insertions(+), 4 deletions(-)
6bbd11
6bbd11
--- autofs-5.0.7.orig/CHANGELOG
6bbd11
+++ autofs-5.0.7/CHANGELOG
6bbd11
@@ -141,6 +141,7 @@
6bbd11
 - check amd lex buffer len before copy.
6bbd11
 - add return check in ldap check_map_indirect().
6bbd11
 - check host macro is set before use.
6bbd11
+- check options length before use in parse_amd.c.
6bbd11
 
6bbd11
 25/07/2012 autofs-5.0.7
6bbd11
 =======================
6bbd11
--- autofs-5.0.7.orig/modules/parse_amd.c
6bbd11
+++ autofs-5.0.7/modules/parse_amd.c
6bbd11
@@ -906,9 +906,20 @@ static int do_auto_mount(struct autofs_p
6bbd11
 {
6bbd11
 	char target[PATH_MAX + 1];
6bbd11
 
6bbd11
-	if (!entry->map_type)
6bbd11
+	if (!entry->map_type) {
6bbd11
+		if (strlen(entry->fs) > PATH_MAX) {
6bbd11
+			error(ap->logopt, MODPREFIX
6bbd11
+			     "error: fs option length is too long");
6bbd11
+			return 0;
6bbd11
+		}
6bbd11
 		strcpy(target, entry->fs);
6bbd11
-	else {
6bbd11
+	} else {
6bbd11
+		if (strlen(entry->fs) +
6bbd11
+		    strlen(entry->map_type) + 5 > PATH_MAX) {
6bbd11
+			error(ap->logopt, MODPREFIX
6bbd11
+			     "error: fs + maptype options length is too long");
6bbd11
+			return 0;
6bbd11
+		}
6bbd11
 		strcpy(target, entry->map_type);
6bbd11
 		strcat(target, ",amd:");
6bbd11
 		strcat(target, entry->fs);
6bbd11
@@ -925,10 +936,21 @@ static int do_link_mount(struct autofs_p
6bbd11
 	const char *opts = (entry->opts && *entry->opts) ? entry->opts : NULL;
6bbd11
 	int ret;
6bbd11
 
6bbd11
-	if (entry->sublink)
6bbd11
+	if (entry->sublink) {
6bbd11
+		if (strlen(entry->sublink) > PATH_MAX) {
6bbd11
+			error(ap->logopt, MODPREFIX
6bbd11
+			     "error: sublink option length is too long");
6bbd11
+			return 0;
6bbd11
+		}
6bbd11
 		strcpy(target, entry->sublink);
6bbd11
-	else
6bbd11
+	} else {
6bbd11
+		if (strlen(entry->fs) > PATH_MAX) {
6bbd11
+			error(ap->logopt, MODPREFIX
6bbd11
+			     "error: fs option length is too long");
6bbd11
+			return 0;
6bbd11
+		}
6bbd11
 		strcpy(target, entry->fs);
6bbd11
+	}
6bbd11
 
6bbd11
 	if (!(flags & CONF_AUTOFS_USE_LOFS))
6bbd11
 		goto symlink;
6bbd11
@@ -1017,6 +1039,12 @@ static int do_nfs_mount(struct autofs_po
6bbd11
 	unsigned int umount = 0;
6bbd11
 	int ret = 0;
6bbd11
 
6bbd11
+	if (strlen(entry->rhost) + strlen(entry->rfs) + 1 > PATH_MAX) {
6bbd11
+		error(ap->logopt, MODPREFIX
6bbd11
+		     "error: rhost + rfs options length is too long");
6bbd11
+		return 0;
6bbd11
+	}
6bbd11
+
6bbd11
 	strcpy(target, entry->rhost);
6bbd11
 	strcat(target, ":");
6bbd11
 	strcat(target, entry->rfs);