From 59cc2fe72a6334610c98b10402401ed4318b731a Mon Sep 17 00:00:00 2001 From: david Date: Sun, 18 Sep 2016 20:42:56 +0000 Subject: [PATCH] Avoid eating 'T' 'U' 'S' 'P' not followed by ':' in getpts. On reading 'T', 'U', 'S', or 'P', getpts_aux would unconditionally consume the character before checking to see whether it was followed by a ':'. You could insert 'T', 'U', 'S', or 'P' in several places and it would just be ignored, which is different treatment than other letters got. Behavior before: nmap -p 9 # scans port 9 nmap -p discard # scans port 9 nmap -p Tdiscard # scans port 9 nmap -p T:Tdiscard # scans port 9 nmap -p Tdi*ard # scans port 9 nmap -p Xdiscard # Error #485: Your port specifications are illegal. Example of proper form: "-100,200-1024,T:3000-4000,U:60000-" Behavior after: nmap -p 9 # scans port 9 nmap -p discard # scans port 9 nmap -p Tdiscard # Error #485: Your port specifications are illegal. Example of proper form: "-100,200-1024,T:3000-4000,U:60000-" nmap -p T:Tdiscard # Error #485: Your port specifications are illegal. Example of proper form: "-100,200-1024,T:3000-4000,U:60000-" nmap -p Tdi*ard # Error #485: Your port specifications are illegal. Example of proper form: "-100,200-1024,T:3000-4000,U:60000-" nmap -p Xdiscard # Error #485: Your port specifications are illegal. Example of proper form: "-100,200-1024,T:3000-4000,U:60000-" --- CHANGELOG | 4 ++++ nmap.cc | 18 +++++++++--------- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 61c3feec6..14ff06960 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,9 @@ # Nmap Changelog ($Id$); -*-text-*- +o Fixed a bug in port specification parsing that could cause extraneous + 'T', 'U', 'S', and 'P' characters to be ignored when they should have + caused an error. [David Fifield] + o [GH#543] Restored compatibility with LibreSSL, which was lost in adding library version checks for OpenSSL 1.1. [Wonko7] diff --git a/nmap.cc b/nmap.cc index fe397340e..f245a5bd7 100644 --- a/nmap.cc +++ b/nmap.cc @@ -1569,7 +1569,7 @@ void apply_delayed_options() { } // Uncomment the following line to use the common lisp port spec test suite - //printf("port spec: (%d %d %d %d)\n", ports.tcp_count, ports.udp_count, ports.sctp_count, ports.prot_count); exit(0); + printf("port spec: (%d %d %d %d)\n", ports.tcp_count, ports.udp_count, ports.sctp_count, ports.prot_count); exit(0); #ifdef WIN32 if (o.sendpref & PACKET_SEND_IP) { @@ -2668,23 +2668,23 @@ static void getpts_aux(const char *origexpr, int nested, u8 *porttbl, int range_ current_range++; /* I don't know why I should allow spaces here, but I will */ if (change_range_type) { - if (*current_range == 'T' && *++current_range == ':') { - current_range++; + if (*current_range == 'T' && *(current_range+1) == ':') { + current_range += 2; range_type = SCAN_TCP_PORT; continue; } - if (*current_range == 'U' && *++current_range == ':') { - current_range++; + if (*current_range == 'U' && *(current_range+1) == ':') { + current_range += 2; range_type = SCAN_UDP_PORT; continue; } - if (*current_range == 'S' && *++current_range == ':') { - current_range++; + if (*current_range == 'S' && *(current_range+1) == ':') { + current_range += 2; range_type = SCAN_SCTP_PORT; continue; } - if (*current_range == 'P' && *++current_range == ':') { - current_range++; + if (*current_range == 'P' && *(current_range+1) == ':') { + current_range += 2; range_type = SCAN_PROTOCOLS; continue; }