From nobody Fri Sep 30 13:28:39 2022 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Mf9zW2tlSz4dqK0; Fri, 30 Sep 2022 13:28:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Mf9zW2H4Fz3dKR; Fri, 30 Sep 2022 13:28:39 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1664544519; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1SWkhOxIwH405Pz9XoIJtB0xGyvYLiqRp6YSL+DO/P0=; b=SobZBDsGy6YIYzGoNyZMv5c2yDFj1itrCW27uVFE+RR7+T6BOmvq0SS+pcO2iF/8fdnX64 X45uAYsgFoKIofZgLBzgMCmiulc8HwEWJ38QcAxgwpcrfwT0xHUngBIdsIuTs1y6kpGHmS 3xj2s0nh6X0A0qG4YLY+3e8Luvg9RDQbYk02cE988Jw2D9J8mTTM897h61BYDFYBrHyk0Z 6SbueyU+rw4gdiZwYAedSDG+ST/P+RzhT6qPEG2vZc0I1mXPCSBReSlynSECgkXIGNX/5P JvhXK3ljuiNLFv9gkr/ALWVZDPXJdGst4XgJtk2BOrCTlklJnbsL5dpwM7vR+g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Mf9zW1JLsz19kj; Fri, 30 Sep 2022 13:28:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 28UDSdxO044825; Fri, 30 Sep 2022 13:28:39 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 28UDSd82044824; Fri, 30 Sep 2022 13:28:39 GMT (envelope-from git) Date: Fri, 30 Sep 2022 13:28:39 GMT Message-Id: <202209301328.28UDSd82044824@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Cy Schubert Subject: git: 5472eacf527d - stable/13 - Fix CVE-2020-10188 List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cy X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 5472eacf527d3cb914b9176de364fe20fc49588a Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1664544519; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1SWkhOxIwH405Pz9XoIJtB0xGyvYLiqRp6YSL+DO/P0=; b=pAtxo8P/LfMoGuDbcVJ46IkqJMg5Uy4oEmClrNjFrwzg4ssEjwrFxNh4/IM/RwQQaetKF1 dX5a+9JQpOygiKl+A24bO5s4Wal2QQ0kqKRf8YOWlXEApVeLGCkuT+3kRYc27oLUcBMHQk wYQgzmARjxwfSBR0URYJjMmEBts3DO43tnLU1DXmMtcbbwxrOHJjRs7UuLrX7fkLyy8n6r +obk7q4oL9xGVFCvqMOnjqTzRchEs0eS501OQCRUameF9WmTn5zK6eIjXyvtVE/vvU6fM8 elEw48zvRyium1aOW1T27rjPS1aj06XGwuD7wt48AYTdEKrnCxCHoYdVHpiJog== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1664544519; a=rsa-sha256; cv=none; b=ddEVptCX+2mzJxew/CPDxJEp7AmUj88J6xRwsLHai8/H9iVKP7b5BSQIPXBXqX/EeQEu0R iImTRrkvdi2q/aC8C+9rgwgluzIUvGohPasDBzqFX5Dv9hY02geu1lnWrchKq2LvDWOiH/ 5nZY1vqudIcIXjSf7W996e7Famdujz13OH5tRREz7QS+nVaHRSN/raOiwHF8R66aBt+9Ey I612KHfKENowe9sfZ82FZpL0EfhdiP7oMxZrxLbiVPIox4ze/O+a/vPiIMmVcJ2Nyine1u xtFYK14XeHwmHlQaA0fj7Z36cDPHzFMfVOcLHbpwZslriv8gGNovR4jx5m6xoA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=5472eacf527d3cb914b9176de364fe20fc49588a commit 5472eacf527d3cb914b9176de364fe20fc49588a Author: Cy Schubert AuthorDate: 2022-09-21 21:38:08 +0000 Commit: Cy Schubert CommitDate: 2022-09-30 13:28:17 +0000 Fix CVE-2020-10188 Reviewed by: emaste Obtained from: NetBSD 6cc1539c8028b Differential Revision: https://reviews.freebsd.org/D36732 (cherry picked from commit 5760cb266e0ab04c221c2acdb4b6c4c141130ecd) --- contrib/telnet/telnetd/utility.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/contrib/telnet/telnetd/utility.c b/contrib/telnet/telnetd/utility.c index 1ad51c55b177..2e1f61fd5bd9 100644 --- a/contrib/telnet/telnetd/utility.c +++ b/contrib/telnet/telnetd/utility.c @@ -147,31 +147,38 @@ ptyflush(void) * character. */ static char * -nextitem(char *current) +nextitem(char *current, const char *endp) { + if (current >= endp) { + return NULL; + } if ((*current&0xff) != IAC) { return current+1; } + if (current+1 >= endp) { + return NULL; + } switch (*(current+1)&0xff) { case DO: case DONT: case WILL: case WONT: - return current+3; + return current+3 <= endp ? current+3 : NULL; case SB: /* loop forever looking for the SE */ { char *look = current+2; - for (;;) { + while (look < endp) { if ((*look++&0xff) == IAC) { - if ((*look++&0xff) == SE) { + if (look < endp && (*look++&0xff) == SE) { return look; } } } + return NULL; } default: - return current+2; + return current+2 <= endp ? current+2 : NULL; } } /* end of nextitem */ @@ -197,7 +204,7 @@ netclear(void) char *thisitem, *next; char *good; #define wewant(p) ((nfrontp > p) && ((*p&0xff) == IAC) && \ - ((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL)) + (nfrontp > p+1) && ((*(p+1)&0xff) != EC) && ((*(p+1)&0xff) != EL)) #ifdef ENCRYPTION thisitem = nclearto > netobuf ? nclearto : netobuf; @@ -205,7 +212,7 @@ netclear(void) thisitem = netobuf; #endif /* ENCRYPTION */ - while ((next = nextitem(thisitem)) <= nbackp) { + while ((next = nextitem(thisitem, nbackp)) != NULL && (next <= nbackp)) { thisitem = next; } @@ -217,20 +224,23 @@ netclear(void) good = netobuf; /* where the good bytes go */ #endif /* ENCRYPTION */ - while (nfrontp > thisitem) { + while ((thisitem != NULL) && (nfrontp > thisitem)) { if (wewant(thisitem)) { int length; next = thisitem; do { - next = nextitem(next); - } while (wewant(next) && (nfrontp > next)); + next = nextitem(next, nfrontp); + } while ((next != NULL) && wewant(next) && (nfrontp > next)); + if (next == NULL) { + next = nfrontp; + } length = next-thisitem; memmove(good, thisitem, length); good += length; thisitem = next; } else { - thisitem = nextitem(thisitem); + thisitem = nextitem(thisitem, nfrontp); } }