svn commit: r357217 - in releng: 11.3/lib/libfetch 12.0/lib/libfetch 12.1/lib/libfetch

[Gordon Tetlow]

Author: gordon
Date: Tue Jan 28 18:55:25 2020
New Revision: 357217
URL: https://svnweb.freebsd.org/changeset/base/357217

Log:
  Fix libfetch buffer overflow
  
  Reported by:	Duncan Overbruck
  Approved by:	so
  Security:	FreeBSD-SA-20:01.libfetch
  Security:	CVE-2020-7450

Modified:
  releng/11.3/lib/libfetch/fetch.c
  releng/12.0/lib/libfetch/fetch.c
  releng/12.1/lib/libfetch/fetch.c

Modified: releng/11.3/lib/libfetch/fetch.c
==============================================================================
--- releng/11.3/lib/libfetch/fetch.c	Tue Jan 28 18:54:15 2020	(r357216)
+++ releng/11.3/lib/libfetch/fetch.c	Tue Jan 28 18:55:25 2020	(r357217)
@@ -328,6 +328,8 @@ fetch_pctdecode(char *dst, const char *src, size_t dle
 		}
 		if (dlen-- > 0)
 			*dst++ = c;
+		else
+			return (NULL);
 	}
 	return (s);
 }
@@ -375,11 +377,15 @@ fetchParseURL(const char *URL)
 	if (p && *p == '@') {
 		/* username */
 		q = fetch_pctdecode(u->user, URL, URL_USERLEN);
+		if (q == NULL)
+			goto ouch;
 
 		/* password */
-		if (*q == ':')
+		if (*q == ':') {
 			q = fetch_pctdecode(u->pwd, q + 1, URL_PWDLEN);
-
+			if (q == NULL)
+				goto ouch;
+		}
 		p++;
 	} else {
 		p = URL;

Modified: releng/12.0/lib/libfetch/fetch.c
==============================================================================
--- releng/12.0/lib/libfetch/fetch.c	Tue Jan 28 18:54:15 2020	(r357216)
+++ releng/12.0/lib/libfetch/fetch.c	Tue Jan 28 18:55:25 2020	(r357217)
@@ -330,6 +330,8 @@ fetch_pctdecode(char *dst, const char *src, size_t dle
 		}
 		if (dlen-- > 0)
 			*dst++ = c;
+		else
+			return (NULL);
 	}
 	return (s);
 }
@@ -377,11 +379,15 @@ fetchParseURL(const char *URL)
 	if (p && *p == '@') {
 		/* username */
 		q = fetch_pctdecode(u->user, URL, URL_USERLEN);
+		if (q == NULL)
+			goto ouch;
 
 		/* password */
-		if (*q == ':')
+		if (*q == ':') {
 			q = fetch_pctdecode(u->pwd, q + 1, URL_PWDLEN);
-
+			if (q == NULL)
+				goto ouch;
+		}
 		p++;
 	} else {
 		p = URL;

Modified: releng/12.1/lib/libfetch/fetch.c
==============================================================================
--- releng/12.1/lib/libfetch/fetch.c	Tue Jan 28 18:54:15 2020	(r357216)
+++ releng/12.1/lib/libfetch/fetch.c	Tue Jan 28 18:55:25 2020	(r357217)
@@ -330,6 +330,8 @@ fetch_pctdecode(char *dst, const char *src, size_t dle
 		}
 		if (dlen-- > 0)
 			*dst++ = c;
+		else
+			return (NULL);
 	}
 	return (s);
 }
@@ -377,11 +379,15 @@ fetchParseURL(const char *URL)
 	if (p && *p == '@') {
 		/* username */
 		q = fetch_pctdecode(u->user, URL, URL_USERLEN);
+		if (q == NULL)
+			goto ouch;
 
 		/* password */
-		if (*q == ':')
+		if (*q == ':') {
 			q = fetch_pctdecode(u->pwd, q + 1, URL_PWDLEN);
-
+			if (q == NULL)
+				goto ouch;
+		}
 		p++;
 	} else {
 		p = URL;