From 30e2585dd46b62aa3a4abdf6de3f40a20e1743ab Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Jan 23 2013 12:54:51 +0000
Subject: Check that strings do not go beyond the end of the packet body in autofs and SSH requests.


This fixes CVE-2013-0220.

https://fedorahosted.org/sssd/ticket/1781

---

diff --git a/src/responder/autofs/autofssrv_cmd.c b/src/responder/autofs/autofssrv_cmd.c
index b85079d..8a79cec 100644
--- a/src/responder/autofs/autofssrv_cmd.c
+++ b/src/responder/autofs/autofssrv_cmd.c
@@ -940,7 +940,7 @@ sss_autofs_cmd_getautomntent(struct cli_ctx *client)
 
     SAFEALIGN_COPY_UINT32_CHECK(&namelen, body+c, blen, &c);
 
-    if (namelen == 0) {
+    if (namelen == 0 || namelen > blen - c) {
         ret = EINVAL;
         goto done;
     }
@@ -1215,7 +1215,7 @@ sss_autofs_cmd_getautomntbyname(struct cli_ctx *client)
     /* FIXME - split out a function to get string from <len><str>\0 */
     SAFEALIGN_COPY_UINT32_CHECK(&namelen, body+c, blen, &c);
 
-    if (namelen == 0) {
+    if (namelen == 0 || namelen > blen - c) {
         ret = EINVAL;
         goto done;
     }
@@ -1239,7 +1239,7 @@ sss_autofs_cmd_getautomntbyname(struct cli_ctx *client)
     /* FIXME - split out a function to get string from <len><str>\0 */
     SAFEALIGN_COPY_UINT32_CHECK(&keylen, body+c, blen, &c);
 
-    if (keylen == 0) {
+    if (keylen == 0 || keylen > blen - c) {
         ret = EINVAL;
         goto done;
     }
diff --git a/src/responder/ssh/sshsrv_cmd.c b/src/responder/ssh/sshsrv_cmd.c
index 687e888..aea9719 100644
--- a/src/responder/ssh/sshsrv_cmd.c
+++ b/src/responder/ssh/sshsrv_cmd.c
@@ -693,8 +693,8 @@ ssh_cmd_parse_request(struct ssh_cmd_ctx *cmd_ctx)
     }
 
     SAFEALIGN_COPY_UINT32_CHECK(&name_len, body+c, body_len, &c);
-    if (name_len == 0) {
-        DEBUG(SSSDBG_CRIT_FAILURE, ("Zero-length name is not valid\n"));
+    if (name_len == 0 || name_len > body_len - c) {
+        DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid name length\n"));
         return EINVAL;
     }
 
@@ -716,8 +716,8 @@ ssh_cmd_parse_request(struct ssh_cmd_ctx *cmd_ctx)
 
     if (flags & 1) {
         SAFEALIGN_COPY_UINT32_CHECK(&alias_len, body+c, body_len, &c);
-        if (alias_len == 0) {
-            DEBUG(SSSDBG_CRIT_FAILURE, ("Zero-length alias is not valid\n"));
+        if (alias_len == 0 || alias_len > body_len - c) {
+            DEBUG(SSSDBG_CRIT_FAILURE, ("Invalid alias length\n"));
             return EINVAL;
         }