953926 - snmptrapd crash "buffer overflow detected" at fortify_fail.c

commit 40938a62619590b4ea071ae85baa2f42a0b7fcb2

Author: Jan Safranek <jsafranek@users.sourceforge.net>

Date:   Mon Apr 22 15:00:00 2013 +0200

    Check if 'asn_parse_* ' actually succeeded.

    If not, discard the packet instead of using wrong data.

diff --git a/snmplib/snmp_api.c b/snmplib/snmp_api.c

index e5c45d9..0842842 100644

--- a/snmplib/snmp_api.c

+++ b/snmplib/snmp_api.c

@@ -4709,9 +4709,11 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length)

         case ASN_INTEGER:

             vp->val.integer = (long *) vp->buf;

             vp->val_len = sizeof(long);

-            asn_parse_int(var_val, &len, &vp->type,

+            data = asn_parse_int(var_val, &len, &vp->type,

                           (long *) vp->val.integer,

                           sizeof(*vp->val.integer));

+            if (!data)

+                return -1;

             break;

         case ASN_COUNTER:

         case ASN_GAUGE:

@@ -4719,9 +4721,11 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length)

         case ASN_UINTEGER:

             vp->val.integer = (long *) vp->buf;

             vp->val_len = sizeof(u_long);

-            asn_parse_unsigned_int(var_val, &len, &vp->type,

+            data = asn_parse_unsigned_int(var_val, &len, &vp->type,

                                    (u_long *) vp->val.integer,

                                    vp->val_len);

+            if (!data)

+                return -1;

             break;

 #ifdef NETSNMP_WITH_OPAQUE_SPECIAL_TYPES

         case ASN_OPAQUE_COUNTER64:

@@ -4730,34 +4734,45 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length)

         case ASN_COUNTER64:

             vp->val.counter64 = (struct counter64 *) vp->buf;

             vp->val_len = sizeof(struct counter64);

-            asn_parse_unsigned_int64(var_val, &len, &vp->type,

+            data = asn_parse_unsigned_int64(var_val, &len, &vp->type,

                                      (struct counter64 *) vp->val.

                                      counter64, vp->val_len);

+            if (!data)

+                return -1;

             break;

 #ifdef NETSNMP_WITH_OPAQUE_SPECIAL_TYPES

         case ASN_OPAQUE_FLOAT:

             vp->val.floatVal = (float *) vp->buf;

             vp->val_len = sizeof(float);

-            asn_parse_float(var_val, &len, &vp->type,

+            data = asn_parse_float(var_val, &len, &vp->type,

                             vp->val.floatVal, vp->val_len);

+            if (!data)

+                return -1;

             break;

         case ASN_OPAQUE_DOUBLE:

             vp->val.doubleVal = (double *) vp->buf;

             vp->val_len = sizeof(double);

-            asn_parse_double(var_val, &len, &vp->type,

+            data = asn_parse_double(var_val, &len, &vp->type,

                              vp->val.doubleVal, vp->val_len);

+            if (!data)

+                return -1;

             break;

         case ASN_OPAQUE_I64:

             vp->val.counter64 = (struct counter64 *) vp->buf;

             vp->val_len = sizeof(struct counter64);

-            asn_parse_signed_int64(var_val, &len, &vp->type,

+            data = asn_parse_signed_int64(var_val, &len, &vp->type,

                                    (struct counter64 *) vp->val.counter64,

                                    sizeof(*vp->val.counter64));

+            if (!data)

+                return -1;

             break;

 #endif                          /* NETSNMP_WITH_OPAQUE_SPECIAL_TYPES */

-        case ASN_OCTET_STR:

         case ASN_IPADDRESS:

+            if (vp->val_len != 4)

+                return -1;

+            /* fallthrough */

+        case ASN_OCTET_STR:

         case ASN_OPAQUE:

         case ASN_NSAP:

             if (vp->val_len < sizeof(vp->buf)) {

@@ -4768,12 +4783,16 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length)

             if (vp->val.string == NULL) {

                 return -1;

             }

-            asn_parse_string(var_val, &len, &vp->type, vp->val.string,

+            data = asn_parse_string(var_val, &len, &vp->type, vp->val.string,

                              &vp->val_len);

+            if (!data)

+                return -1;

             break;

         case ASN_OBJECT_ID:

             vp->val_len = MAX_OID_LEN;

-            asn_parse_objid(var_val, &len, &vp->type, objid, &vp->val_len);

+            data = asn_parse_objid(var_val, &len, &vp->type, objid, &vp->val_len);

+            if (!data)

+                return -1;

             vp->val_len *= sizeof(oid);

             vp->val.objid = (oid *) malloc(vp->val_len);

             if (vp->val.objid == NULL) {

@@ -4791,8 +4810,10 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length)

             if (vp->val.bitstring == NULL) {

                 return -1;

             }

-            asn_parse_bitstring(var_val, &len, &vp->type,

+            data = asn_parse_bitstring(var_val, &len, &vp->type,

                                 vp->val.bitstring, &vp->val_len);

+            if (!data)

+                return -1;

             break;

         default:

             snmp_log(LOG_ERR, "bad type returned (%x)\n", vp->type);

commit aa4fb949012d7c022a436992ac203c065fd7420a

Author: Jan Safranek <jsafranek@users.sourceforge.net>

Date:   Mon Apr 22 14:58:41 2013 +0200

    Integer values encoded in BER must have at least one character.

    If asn_length == 0, we would read the first byte of the next varbind on next line:

        if (*bufp & 0x80)

    -> reading past the buffer if there is no such variable -> sigsegv.

diff --git a/snmplib/asn1.c b/snmplib/asn1.c

index 1af7787..5de6b75 100644

--- a/snmplib/asn1.c

+++ b/snmplib/asn1.c

@@ -510,7 +510,7 @@ asn_parse_int(u_char * data,

         (errpre, bufp, data, asn_length, *datalength))

         return NULL;

-    if ((size_t) asn_length > intsize) {

+    if ((size_t) asn_length > intsize || (int) asn_length == 0) {

         _asn_length_err(errpre, (size_t) asn_length, intsize);

         return NULL;

     }

@@ -582,7 +582,7 @@ asn_parse_unsigned_int(u_char * data,

         (errpre, bufp, data, asn_length, *datalength))

         return NULL;

-    if ((asn_length > (intsize + 1)) ||

+    if (((int) asn_length > (intsize + 1)) || ((int) asn_length == 0) ||

         ((asn_length == intsize + 1) && *bufp != 0x00)) {

         _asn_length_err(errpre, (size_t) asn_length, intsize);

         return NULL;