aniani/icecast-server
1
0
Fork 0
mirror of https://gitlab.xiph.org/xiph/icecast-server.git synced 2025-02-02 15:07:36 -05:00
Code

Fix: Fixed buffer overflow in URL auth code.

Browse Source 
Closes: #2342
This commit is contained in:
Philipp Schafft 2018-10-17 10:23:33 +00:00
parent e75b85fe66
commit 081a7974e6
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/auth_url.c
View File

@ -513,13 +513,25 @@ static auth_result url_add_client(auth_client *auth_user)
header_val = httpp_getvar (client->parser, cur_header); header_val = httpp_getvar (client->parser, cur_header);
if (header_val) { if (header_val) {
size_t left = sizeof(post) - post_offset;
int ret;
header_valesc = util_url_escape (header_val); header_valesc = util_url_escape (header_val);
post_offset += snprintf(post + post_offset, ret = snprintf(post + post_offset,
sizeof(post) - post_offset, sizeof(post) - post_offset,
"&%s%s=%s", "&%s%s=%s",
url->prefix_headers ? url->prefix_headers : "", url->prefix_headers ? url->prefix_headers : "",
cur_header, header_valesc); cur_header, header_valesc);
free(header_valesc); free(header_valesc);
if (ret <= 0 || (size_t)ret >= left) {
ICECAST_LOG_ERROR("Authentication failed for client %p as header \"%H\" is too long.", client, cur_header);
free(pass_headers);
auth_user_url_clear(auth_user);
return AUTH_FAILED;
} else {
post_offset += ret;
}
} }
cur_header = next_header; cur_header = next_header;