From nobody Fri Sep 30 13:29:17 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4MfB0G20RNz4dqK3; Fri, 30 Sep 2022 13:29:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4MfB0G1QXYz3dZd; Fri, 30 Sep 2022 13:29:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1664544558; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dDh6uAZiW6tMQ3kNPs4GNJ2xB9SEqvmRPoury1jQbQo=; b=gdYOykMc4Ra5p1A5TSwBruhwzBZQAelD4vcBPPIHCScMivyAk2PGMUp+HjaALocn5AmrOw j1X8vkxxbEVvk6FoFANbtRpNJv8tDKB682n39AcqK+y/XifugFbev3AwTevR7Twd9PWETS RUIkdUndOUYi7n8Jzr6GiIrrU5UpYtkKwIkbGPz93qbAgMn0w48wgjPCvoVG/hLI6265qN ADbp7uJBbasT3KnP+VV+x5nCWEFrWOK0lWWk7m88EJMv86WeJAUVWc3wxbxUtwllGrVpc1 YqMXyXZtSsTSXYK4uB675SXHEUIpfawaRg9TKubNF0IEDzLkmf2rHFN8C2JiLg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4MfB0G0RY3z19tL; Fri, 30 Sep 2022 13:29:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 28UDTHsm044993; Fri, 30 Sep 2022 13:29:17 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 28UDTHZ6044992; Fri, 30 Sep 2022 13:29:17 GMT (envelope-from git) Date: Fri, 30 Sep 2022 13:29:17 GMT Message-Id: <202209301329.28UDTHZ6044992@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Cy Schubert Subject: git: 229863871f52 - stable/12 - Fix CVE-2020-10188 List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cy X-Git-Repository: src X-Git-Refname: refs/heads/stable/12 X-Git-Reftype: branch X-Git-Commit: 229863871f52ee8f1a08f40c330eeb9e8bab9bb3 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1664544558; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dDh6uAZiW6tMQ3kNPs4GNJ2xB9SEqvmRPoury1jQbQo=; b=WlmxV1SorHU0GoO8zVJKw9pWQgcnTgFQWNxeqi1kfpVFmBLU4HaNPQqJybsufD89QdPE8f Soa6g7vbp0oXSG/mogHh3W31gq9+ZBm1yVNwKApyXH7QAzfM5NcMSKJwVpFhS3f+M5VK19 5uAUMBlzfjPbyqcUOvjbJyBCkkUyOTEi5Lo4R2PSiF9u+yIL94otvEZC6ZfQoC0lHzGf+C IBRUBXv5pUIUGeJ+zTSLhRX+RLBO4ZIoSbiSnnvl5VEEsVZr1lJvzhxrYiLb/V2zvgAYyN OKtPbHXv7sX5xZuf5niQyBAvsegzN5LhE/dPQg4Ze2+fOgpxE8a4fhZmm2wM6g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1664544558; a=rsa-sha256; cv=none; b=SZe8sNt1ySUzOZB7ujd55sWyv8ifh1DX7aK2g+hVYUkTvXbQI+i3cDtnmJwrynJ6YsTnpc rs7L8Z1tezElQtbYOMAGvdRhN6kfvAX7k2K03khG93PEUNd+h0kZqXk74cRkb3INkcpVl6 tJcqmjgkA03a8Fa6iJa+zNBkk/3/gg19pKFNNt7tvCxO5eB6hVdgzkYRKVqaMgmB324tkt HaUKvHz799ekW4RFab7Ly8kyRqE76D2qrL4mp+PBoAYbzIJepeuBrVvLm9qF8qos1o4zS0 Shy0yss3Jnv8kTqmtu4pZicmWcLrsS9iHHRGm3jKBirCQ+NLc0AoDQUvUvImcA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/12 has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=229863871f52ee8f1a08f40c330eeb9e8bab9bb3 commit 229863871f52ee8f1a08f40c330eeb9e8bab9bb3 Author: Cy Schubert AuthorDate: 2022-09-21 21:38:08 +0000 Commit: Cy Schubert CommitDate: 2022-09-30 00:09:49 +0000 Fix CVE-2020-10188 Reviewed by: emaste Obtained from: NetBSD 6cc1539c8028b MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D36732 (cherry picked from commit 5760cb266e0ab04c221c2acdb4b6c4c141130ecd) --- contrib/telnet/telnetd/utility.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/contrib/telnet/telnetd/utility.c b/contrib/telnet/telnetd/utility.c index 1ad51c55b177..2e1f61fd5bd9 100644 --- a/contrib/telnet/telnetd/utility.c +++ b/contrib/telnet/telnetd/utility.c @@ -147,31 +147,38 @@ ptyflush(void) * character. */ static char * -nextitem(char *current) +nextitem(char *current, const char *endp) { + if (current >= endp) { + return NULL; + } if ((*current&0xff) != IAC) { return current+1; } + if (current+1 >= endp) { + return NULL; + } switch (*(current+1)&0xff) { case DO: case DONT: case WILL: case WONT: - return current+3; + return current+3 <= endp ? current+3 : NULL; case SB: /* loop forever looking for the SE */ { char *look = current+2; - for (;;) { + while (look < endp) { if ((*look++&0xff) == IAC) { - if ((*look++&0xff) == SE) { + if (look < endp && (*look++&0xff) == SE) { return look; } } } + return NULL; } default: - return current+2; + return current+2 <= endp ? current+2 : NULL; } } /* end of nextitem */ @@ -197,7 +204,7 @@ netclear(void) char *thisitem, *next; char *good; #define wewant(p) ((nfrontp > p) && ((*p&0xff) == IAC) && \ - ((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL)) + (nfrontp > p+1) && ((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL)) #ifdef ENCRYPTION thisitem = nclearto > netobuf ? nclearto : netobuf; @@ -205,7 +212,7 @@ netclear(void) thisitem = netobuf; #endif /* ENCRYPTION */ - while ((next = nextitem(thisitem)) <= nbackp) { + while ((next = nextitem(thisitem, nbackp)) != NULL && (next <= nbackp)) { thisitem = next; } @@ -217,20 +224,23 @@ netclear(void) good = netobuf; /* where the good bytes go */ #endif /* ENCRYPTION */ - while (nfrontp > thisitem) { + while ((thisitem != NULL) && (nfrontp > thisitem)) { if (wewant(thisitem)) { int length; next = thisitem; do { - next = nextitem(next); - } while (wewant(next) && (nfrontp > next)); + next = nextitem(next, nfrontp); + } while ((next != NULL) && wewant(next) && (nfrontp > next)); + if (next == NULL) { + next = nfrontp; + } length = next-thisitem; memmove(good, thisitem, length); good += length; thisitem = next; } else { - thisitem = nextitem(thisitem); + thisitem = nextitem(thisitem, nfrontp); } }