aniani/icecast-server
1
0
Fork 0
mirror of https://gitlab.xiph.org/xiph/icecast-server.git synced 2024-06-16 06:15:24 +00:00
Code

Fix: Fixed bufferoverflow within url_add_client()

Browse Source 
This can be trigged by:
* overly long username,
* overly long password,
* overly long user agent string,
* overly long path.
This commit is contained in:
Philipp Schafft 2018-10-17 11:25:06 +00:00
parent 081a7974e6
commit 548e7963a7
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/auth_url.c
View File

@ -343,6 +343,7 @@ static auth_result url_remove_client(auth_client *auth_user)
const char *agent;
char *user_agent,
*ipaddr;
int ret;
if (url->removeurl == NULL)
return AUTH_OK;
@ -378,7 +379,7 @@ static auth_result url_remove_client(auth_client *auth_user)
mount = util_url_escape(mountreq);
ipaddr = util_url_escape(client->con->ip);
snprintf(post, sizeof (post),
ret = snprintf(post, sizeof(post),
"action=%s&server=%s&port=%d&client=%lu&mount=%s"
"&user=%s&pass=%s&duration=%lu&ip=%s&agent=%s",
url->removeaction, /* already escaped */
@ -392,6 +393,12 @@ static auth_result url_remove_client(auth_client *auth_user)
free(ipaddr);
free(user_agent);
if (ret <= 0 || ret >= (ssize_t)sizeof(post)) {
ICECAST_LOG_ERROR("Authentication failed for client %p as header POST data is too long.", client);
auth_user_url_clear(auth_user);
return AUTH_FAILED;
}
if (strchr (url->removeurl, '@') == NULL) {
if (url->userpwd) {
curl_easy_setopt(url->handle, CURLOPT_USERPWD, url->userpwd);
@ -499,6 +506,13 @@ static auth_result url_add_client(auth_client *auth_user)
free(password);
free(ipaddr);
if (post_offset <= 0 || post_offset >= (ssize_t)sizeof(post)) {
ICECAST_LOG_ERROR("Authentication failed for client %p as header POST data is too long.", client);
auth_user_url_clear(auth_user);
return AUTH_FAILED;
}
pass_headers = NULL;
if (url->pass_headers)
pass_headers = strdup(url->pass_headers);