From 757609ad8a7f566a1f052c46a3624bb73ed2a207 Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Thu, 16 Apr 2026 23:36:47 +0000
Subject: [PATCH] Double-check length in SOCKS5 response processing

---
 CHANGELOG           | 5 +++++
 ncat/ncat_connect.c | 8 ++++++++
 2 files changed, 13 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 7abbbf90f..32d2e7378 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,10 @@
 #Nmap Changelog ($Id$); -*-text-*-
 
+o [Ncat] Fix several cases where Ncat's SOCKS5 client could interpret
+  uninitialized data as protocol data, triggered by a malicious SOCKS5 proxy
+  server. No code execution or application crash is possible.
+  Reported by Govind Pratap Singh. [Daniel Miller]
+
 o Fix a out-of-bounds access in Nping Echo client allowing a malicious Nping
   EchoServer to zero 32 bytes of memory outside the packet buffer. Reported by
   Harshit Gupta. [Daniel Miller]
diff --git a/ncat/ncat_connect.c b/ncat/ncat_connect.c
index f12f433bc..a543072b2 100644
--- a/ncat/ncat_connect.c
+++ b/ncat/ncat_connect.c
@@ -903,6 +903,14 @@ static int do_proxy_socks5(void)
         return -1;
     }
 
+    /* Not possible, since bndaddrlen cannot be more than UCHAR_MAX + 2, which
+     * is equal to sizeof(bndaddr), but we will be cautious. */
+    if (bndaddrlen > sizeof(bndaddr)) {
+      loguser("Error: proxy bind address length too long.\n");
+      close(sd);
+      return -1;
+    }
+
     if (recv_bytes(sd, bndaddr, bndaddrlen) < bndaddrlen) {
         loguser("Error: malformed request response from proxy.\n");
         close(sd);