CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-03 22:29:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Check string bounds looking for terminating ']'.

Browse source 
It was possible to trigger an out-of-bounds read by giving a port
specification with '[' but not ']'.
This commit is contained in:
david 2014-12-20 19:12:09 +00:00
parent 742444b87d
commit 934de74bb0
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nmap.cc
View file

@ -2627,8 +2627,10 @@ static void getpts_aux(const char *origexpr, int nested, u8 *porttbl, int range_
getpts_aux(++current_range, 1, porttbl, range_type, portwarning);
// Skip past the ']'. This is OK because we can't nest []s
while (*current_range != ']') current_range++;
current_range++;
while (*current_range != ']' && *current_range != '\0')
current_range++;
if (*current_range == ']')
current_range++;
// Skip over a following ',' so we're ready to keep parsing
if (*current_range == ',')