diff options
| author | dtucker@openbsd.org <dtucker@openbsd.org> | 2024-12-05 07:47:00 +0100 |
|---|---|---|
| committer | Darren Tucker <dtucker@dtucker.net> | 2024-12-05 09:13:42 +0100 |
| commit | 9998c93d57bf0f1df2bc93e0bc2d8112c6f8c720 (patch) | |
| tree | 5ca243d7e93e39e9fa74667f8d9ead468f7aaba7 | |
| parent | upstream: add a work-in-progress tool to verify FIDO attestation (diff) | |
| download | openssh-9998c93d57bf0f1df2bc93e0bc2d8112c6f8c720.tar.xz openssh-9998c93d57bf0f1df2bc93e0bc2d8112c6f8c720.zip | |
upstream: Prevent integer overflow in x11 port handling. These are
theoretically possible if the admin misconfigures X11DisplayOffset or the
user misconfigures their own $DISPLAY, but don't happen in normal operation.
From Suhov Roman via bz#3730, ok djm@
OpenBSD-Commit-ID: e9e3860f1a19b862ccf07dc8ecbe8f1e1034f4ed
| -rw-r--r-- | channels.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/channels.c b/channels.c index 8ebe21c40..1a95301e7 100644 --- a/channels.c +++ b/channels.c @@ -1,4 +1,4 @@ -/* $OpenBSD: channels.c,v 1.440 2024/10/13 22:20:06 djm Exp $ */ +/* $OpenBSD: channels.c,v 1.441 2024/12/05 06:47:00 dtucker Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -4998,13 +4998,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset, u_int *display_numberp, int **chanids) { Channel *nc = NULL; - int display_number, sock; - u_short port; + int display_number, sock, port; struct addrinfo hints, *ai, *aitop; char strport[NI_MAXSERV]; int gaierr, n, num_socks = 0, socks[NUM_SOCKS]; - if (chanids == NULL) + if (chanids == NULL || x11_display_offset < 0 || + x11_display_offset > UINT16_MAX - 6000 - MAX_DISPLAYS) return -1; for (display_number = x11_display_offset; @@ -5226,7 +5226,8 @@ x11_connect_display(struct ssh *ssh) * buf now contains the host name. But first we parse the * display number. */ - if (sscanf(cp + 1, "%u", &display_number) != 1) { + if (sscanf(cp + 1, "%u", &display_number) != 1 || + display_number > UINT16_MAX - 6000) { error("Could not parse display number from DISPLAY: %.100s", display); return -1; |