From 534fb389bb3c26e750d7be69c7554c025c64dcfe Mon Sep 17 00:00:00 2001 From: Mark Wooding Date: Fri, 28 Apr 2017 22:51:36 +0100 Subject: [PATCH] site.c: Make sure there's enough buffer space for the signature terminator. Signed-off-by: Mark Wooding --- site.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/site.c b/site.c index e8ab493..0da21ef 100644 --- a/site.c +++ b/site.c @@ -713,6 +713,13 @@ static bool_t unpick_msg(struct site *st, uint32_t type, CHECK_AVAIL(msg,m->siglen); m->sig=buf_unprepend(msg,m->siglen); CHECK_EMPTY(msg); + + /* In `process_msg3_msg4' below, we assume that we can write a nul + * terminator following the signature. Make sure there's enough space. + */ + if (msg->start >= msg->base + msg->alloclen) + return False; + return True; } @@ -846,7 +853,7 @@ static bool_t process_msg3_msg4(struct site *st, struct msg *m) hst=st->hash->init(); st->hash->update(hst,m->hashstart,m->hashlen); st->hash->final(hst,hash); - /* Terminate signature with a '0' - cheating, but should be ok */ + /* Terminate signature with a '0' - already checked that this will fit */ m->sig[m->siglen]=0; if (!st->pubkey->check(st->pubkey->st,hash,st->hash->len,m->sig)) { slog(st,LOG_SEC,"msg3/msg4 signature failed check!"); -- 2.30.2