From 934de74bb020821913b6b345c9043b7928fe0100 Mon Sep 17 00:00:00 2001 From: david Date: Sat, 20 Dec 2014 19:12:09 +0000 Subject: [PATCH] Check string bounds looking for terminating ']'. It was possible to trigger an out-of-bounds read by giving a port specification with '[' but not ']'. --- nmap.cc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/nmap.cc b/nmap.cc index 561776bc7..2fd8f66df 100644 --- a/nmap.cc +++ b/nmap.cc @@ -2627,8 +2627,10 @@ static void getpts_aux(const char *origexpr, int nested, u8 *porttbl, int range_ getpts_aux(++current_range, 1, porttbl, range_type, portwarning); // Skip past the ']'. This is OK because we can't nest []s - while (*current_range != ']') current_range++; - current_range++; + while (*current_range != ']' && *current_range != '\0') + current_range++; + if (*current_range == ']') + current_range++; // Skip over a following ',' so we're ready to keep parsing if (*current_range == ',')