CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-31 15:03:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix reported integer underflow. No existing patterns affected

Browse source
This commit is contained in:
dmiller 2026-05-26 01:52:13 +00:00
parent b0293fe9fe
commit 9f8c9624f5
2 changed files with 12 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGELOG
View file

@ -1,5 +1,9 @@
#Nmap Changelog ($Id$); -*-text-*-
o Fixed an integer underflow in service_scan.cc that would cause little-endian
integers extracted from the beginning of a service banner to be interpreted
as 0. Discovered with AFL++ by Malek Althubiany.
o [NSE][GH#3250][GH#3206] Fix assertion failures in cases where connect or send
returns immediately with a status other than ERROR, e.g. TIMEOUT or CANCELED.
[Daniel Miller]

22
service_scan.cc
View file

@ -817,7 +817,6 @@ static char *substvar(char *tmplvar, char **tmplvarend,
} else if (strcmp(substcommand, "I") == 0 ){
// Parse an unsigned int
long long unsigned val = 0;
bool bigendian = true;
char buf[24]; //0xffffffffffffffff = 18446744073709551615, 20 chars
int buflen;
if (command_args.num_args != 2 ||
@ -839,25 +838,20 @@ static char *substvar(char *tmplvar, char **tmplvarend,
return NULL;
}
switch (command_args.str_args[1][0]) {
case '>':
bigendian = true;
case '>': // big endian
for(PCRE2_SIZE i=offstart; i < offend; i++) {
val = (val<<8) + subject[i];
}
break;
case '<':
bigendian = false;
case '<': // little endian
for(PCRE2_SIZE i=offend; i > offstart; i--) {
val = (val<<8) + subject[i-1];
}
break;
default:
return NULL;
break;
}
if (bigendian) {
for(PCRE2_SIZE i=offstart; i < offend; i++) {
val = (val<<8) + subject[i];
}
} else {
for(PCRE2_SIZE i=offend - 1; i > offstart - 1; i--) {
val = (val<<8) + subject[i];
}
}
buflen = Snprintf(buf, sizeof(buf), "%llu", val);
if (buflen < 0 || buflen >= (int) sizeof(buf)) {
return NULL;