CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-04 06:40:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Correctly null-terminate some strings in idle_scan

Browse source 
Reported by Gisle Vanem: http://seclists.org/nmap-dev/2014/q4/82
This commit is contained in:
dmiller 2014-10-22 12:56:32 +00:00
parent fefcca1623
commit 814bf97a8f
2 changed files with 16 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

18
idle_scan.cc
View file

@ -590,15 +590,23 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
}
/* If we have a : in IPv4 or [] in IPv6, we strip them off */
if (o.af() == AF_INET && strchr(proxyName, ':') != NULL )
strncpy(name, proxyName , MIN(strcspn(proxyName,":") , sizeof(name)));
else if (o.af() == AF_INET6 && strchr(proxyName, '[') != NULL && strchr(proxyName, ']') != NULL)
strncpy(name, strchr(proxyName, '[') + 1, MIN(strcspn(proxyName,"]") - strcspn(proxyName, "[") - 1, sizeof(name)));
if (o.af() == AF_INET && q != NULL ) {
/* I'm lazy, using a size_t we already had around */
sslen = MIN(strcspn(proxyName,":"), sizeof(name) - 1);
strncpy(name, proxyName, sslen);
/* Ensure NULL termination */
name[sslen] = '\0';
}
else if (o.af() == AF_INET6 && strchr(proxyName, '[') != NULL && strchr(proxyName, ']') != NULL) {
sslen = MIN(strcspn(proxyName,"]") - strcspn(proxyName, "[") - 1, sizeof(name) - 1);
strncpy(name, strchr(proxyName, '[') + 1, sslen);
name[sslen] = '\0';
}
else
strncpy(name, proxyName, sizeof(name));
if (q) {
*q++ = '\0';
q++;
proxy->probe_port = strtoul(q, &endptr, 10);
if (*q == 0 || !endptr || *endptr != '\0' || !proxy->probe_port) {
fatal("Invalid port number given in IP ID zombie specification: %s", proxyName);

3
nmap.cc
View file

@ -922,6 +922,9 @@ void parse_options(int argc, char **argv) {
} else if (strcmp(long_options[option_index].name, "sI") == 0) {
o.idlescan = 1;
o.idleProxy = strdup(optarg);
if (strlen(o.idleProxy) > MAXHOSTNAMELEN) {
fatal("ERROR: -sI argument must be less than %d characters", MAXHOSTNAMELEN);
}
} else if (strcmp(long_options[option_index].name, "vv") == 0) {
/* Compatibility hack ... ugly */
o.verbose += 2;