CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-10-20 19:01:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix a write overrun in the -g option to Ncat

Browse source 
Due to the use of do{}while; the bounds were checked *after* writing to
the array of source routes. Reproduce:
ncat $(perl -E 'say "-g 1.1.1.1 "x100') scanme.nmap.org 80
This commit is contained in:
dmiller 2015-06-23 03:59:41 +00:00
parent eda09854ac
commit df5d9a7489
1 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
ncat/ncat_main.c
View file

@ -372,20 +372,23 @@ int main(int argc, char *argv[])
o.execmode = EXEC_PLAIN;
break;
case 'g': {
char *a = strtok(optarg, ",");
do {
char *from = optarg;
char *a = NULL;
while (o.numsrcrtes < 8 && (a = strtok(from, ",")))
{
union sockaddr_u addr;
size_t sslen;
int rc;
from = NULL;
rc = resolve(a, 0, &addr.storage, &sslen, AF_INET);
if (rc != 0) {
bye("Sorry, could not resolve source route hop \"%s\": %s.",
a, gai_strerror(rc));
}
o.srcrtes[o.numsrcrtes] = addr.in.sin_addr;
} while (++o.numsrcrtes < 8 && (a = strtok(NULL, ",")));
if (strtok(NULL, ","))
o.srcrtes[o.numsrcrtes++] = addr.in.sin_addr;
}
if (strtok(from, ","))
bye("Sorry, you gave too many source route hops.");
break;
}