Double-check length in SOCKS5 response processing

CHANGELOG

@@ -1,5 +1,10 @@
 #Nmap Changelog ($Id$); -*-text-*-
 
+o [Ncat] Fix several cases where Ncat's SOCKS5 client could interpret
+  uninitialized data as protocol data, triggered by a malicious SOCKS5 proxy
+  server. No code execution or application crash is possible.
+  Reported by Govind Pratap Singh. [Daniel Miller]
+
 o Fix a out-of-bounds access in Nping Echo client allowing a malicious Nping
   EchoServer to zero 32 bytes of memory outside the packet buffer. Reported by
   Harshit Gupta. [Daniel Miller]

ncat/ncat_connect.c

@@ -903,6 +903,14 @@ static int do_proxy_socks5(void)
         return -1;
     }
 
+    /* Not possible, since bndaddrlen cannot be more than UCHAR_MAX + 2, which
+     * is equal to sizeof(bndaddr), but we will be cautious. */
+    if (bndaddrlen > sizeof(bndaddr)) {
+      loguser("Error: proxy bind address length too long.\n");
+      close(sd);
+      return -1;
+    }
+
     if (recv_bytes(sd, bndaddr, bndaddrlen) < bndaddrlen) {
         loguser("Error: malformed request response from proxy.\n");
         close(sd);