GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-08-08 09:21:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

main: bound-check sec-mod message length before allocation

Browse Source 
handle_sec_mod_commands() lacked an upper-bound check on the `length`
field received from the sec-mod socket before passing it to talloc_size().
The worker command handler already applies a MAX_MSG_SIZE guard.

Replace the redundant (int)length < 0 cast (impossible for uint32_t) with
a length > MAX_MSG_SIZE check, matching the pattern in handle_worker_commands().
Also fix the format specifier from %d to %u for the uint32_t length.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This commit is contained in:
Nikos Mavrogiannopoulos
2026-04-16 22:46:41 +02:00
parent 8355aa080e
commit a0504dd5a7
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main-sec-mod-cmd.c
+3 -3
View File
@@ -111,10 +111,10 @@ int handle_sec_mod_commands(sec_mod_instance_st *sec_mod_instance)
}
if (ret < 5 || cmd <= MIN_SECM_CMD || cmd >= MAX_SECM_CMD ||
(int)length < 0) {
length > MAX_MSG_SIZE) {
mslog(s, NULL, LOG_ERR,
"main received invalid message from sec-mod of %d bytes (cmd: %u)\n",
(int)length, (unsigned int)cmd);
"main received invalid message from sec-mod of %u bytes (cmd: %u)\n",
(unsigned int)length, (unsigned int)cmd);
return ERR_BAD_COMMAND;
}