CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-10-21 03:11:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix a potential buffer overrun due to sscanf using the wrong field width

Browse source
This commit is contained in:
dmiller 2016-07-27 20:11:27 +00:00
parent 040d8e9c0f
commit 85dd7e6ac1
2 changed files with 19 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

17
libdnet-stripped/NMAP_MODIFICATIONS
View file

@ -2318,3 +2318,20 @@ index 77225b6..baf02ce 100644
if (entry->intf_addr.addr_type == ADDR_TYPE_NONE) {
/* Set primary address if unset. */
o Avoid buffer overrun from scanning 32 chars plus terminator into a 16-byte buffer.
diff --git a/libdnet-stripped/src/intf.c b/libdnet-stripped/src/intf.c
index 315e7b0..6180d85 100644
--- a/libdnet-stripped/src/intf.c
+++ b/libdnet-stripped/src/intf.c
@@ -776,7 +776,8 @@ _intf_get_aliases(intf_t *intf, struct intf_entry *entry)
if ((f = fopen(PROC_INET6_FILE, "r")) != NULL) {
while (ap < lap &&
fgets(buf, sizeof(buf), f) != NULL) {
- sscanf(buf, "%04s%04s%04s%04s%04s%04s%04s%04s %x %02x %02x %02x %32s\n",
+ /* scan up to INTF_NAME_LEN-1 bytes to reserve space for null terminator */
+ sscanf(buf, "%04s%04s%04s%04s%04s%04s%04s%04s %x %02x %02x %02x %15s\n",
s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7],
&idx, &bits, &scope, &flags, name);
if (strcmp(name, entry->intf_name) == 0) {

3
libdnet-stripped/src/intf.c
View file

@ -776,7 +776,8 @@ _intf_get_aliases(intf_t *intf, struct intf_entry *entry)
if ((f = fopen(PROC_INET6_FILE, "r")) != NULL) {
while (ap < lap &&
fgets(buf, sizeof(buf), f) != NULL) {
sscanf(buf, "%04s%04s%04s%04s%04s%04s%04s%04s %x %02x %02x %02x %32s\n",
/* scan up to INTF_NAME_LEN-1 bytes to reserve space for null terminator */
sscanf(buf, "%04s%04s%04s%04s%04s%04s%04s%04s %x %02x %02x %02x %15s\n",
s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7],
&idx, &bits, &scope, &flags, name);
if (strcmp(name, entry->intf_name) == 0) {