From d62ed72daacc95e75bd0a617af9e4d88829b2e77 Mon Sep 17 00:00:00 2001

From: Mariusz Ziulek <mzet@owasp.org>

Date: Sat, 21 Feb 2015 23:31:36 +0100

Subject: [PATCH] kex: bail out on rubbish in the incoming packet

CVE-2015-1782

Bug: http://www.libssh2.org/adv_20150311.html

Upstream-commit: 7d94b69b802c03e8d7726f4ae61baba52cb7d871

Signed-off-by: Kamil Dudka <kdudka@redhat.com>

---

 src/kex.c | 73 +++++++++++++++++++++++++++++++++++----------------------------

 1 file changed, 41 insertions(+), 32 deletions(-)

diff --git a/src/kex.c b/src/kex.c

index fa4c4e1..ad7498a 100644

--- a/src/kex.c

+++ b/src/kex.c

@@ -1549,6 +1549,30 @@ static int kex_agree_comp(LIBSSH2_SESSION *session,

  * The Client gets to make the final call on "agreed methods"

  */

+/*

+ * kex_string_pair() extracts a string from the packet and makes sure it fits

+ * within the given packet.

+ */

+static int kex_string_pair(unsigned char **sp,   /* parsing position */

+                           unsigned char *data,  /* start pointer to packet */

+                           size_t data_len,      /* size of total packet */

+                           size_t *lenp,         /* length of the string */

+                           unsigned char **strp) /* pointer to string start */

+{

+    unsigned char *s = *sp;

+    *lenp = _libssh2_ntohu32(s);

+

+    /* the length of the string must fit within the current pointer and the

+       end of the packet */

+    if (*lenp > (data_len - (s - data) -4))

+        return 1;

+    *strp = s + 4;

+    s += 4 + *lenp;

+

+    *sp = s;

+    return 0;

+}

+

 /* kex_agree_methods

  * Decide which specific method to use of the methods offered by each party

  */

@@ -1568,38 +1592,23 @@ static int kex_agree_methods(LIBSSH2_SESSION * session, unsigned char *data,

     s += 16;

     /* Locate each string */

-    kex_len = _libssh2_ntohu32(s);

-    kex = s + 4;

-    s += 4 + kex_len;

-    hostkey_len = _libssh2_ntohu32(s);

-    hostkey = s + 4;

-    s += 4 + hostkey_len;

-    crypt_cs_len = _libssh2_ntohu32(s);

-    crypt_cs = s + 4;

-    s += 4 + crypt_cs_len;

-    crypt_sc_len = _libssh2_ntohu32(s);

-    crypt_sc = s + 4;

-    s += 4 + crypt_sc_len;

-    mac_cs_len = _libssh2_ntohu32(s);

-    mac_cs = s + 4;

-    s += 4 + mac_cs_len;

-    mac_sc_len = _libssh2_ntohu32(s);

-    mac_sc = s + 4;

-    s += 4 + mac_sc_len;

-    comp_cs_len = _libssh2_ntohu32(s);

-    comp_cs = s + 4;

-    s += 4 + comp_cs_len;

-    comp_sc_len = _libssh2_ntohu32(s);

-    comp_sc = s + 4;

-#if 0

-    s += 4 + comp_sc_len;

-    lang_cs_len = _libssh2_ntohu32(s);

-    lang_cs = s + 4;

-    s += 4 + lang_cs_len;

-    lang_sc_len = _libssh2_ntohu32(s);

-    lang_sc = s + 4;

-    s += 4 + lang_sc_len;

-#endif

+    if(kex_string_pair(&s, data, data_len, &kex_len, &kex))

+       return -1;

+    if(kex_string_pair(&s, data, data_len, &hostkey_len, &hostkey))

+       return -1;

+    if(kex_string_pair(&s, data, data_len, &crypt_cs_len, &crypt_cs))

+       return -1;

+    if(kex_string_pair(&s, data, data_len, &crypt_sc_len, &crypt_sc))

+       return -1;

+    if(kex_string_pair(&s, data, data_len, &mac_cs_len, &mac_cs))

+       return -1;

+    if(kex_string_pair(&s, data, data_len, &mac_sc_len, &mac_sc))

+       return -1;

+    if(kex_string_pair(&s, data, data_len, &comp_cs_len, &comp_cs))

+       return -1;

+    if(kex_string_pair(&s, data, data_len, &comp_sc_len, &comp_sc))

+       return -1;

+

     /* If the server sent an optimistic packet, assume that it guessed wrong.

      * If the guess is determined to be right (by kex_agree_kex_hostkey)

      * This flag will be reset to zero so that it's not ignored */

-- 

2.4.2