| commit | 64ffbe04eaafebf4045a3ace52a360c14959d196 | |
| author | Wolfgang Bumiller <w.bumiller@proxmox.com> | |
| Wed, 13 Jan 2016 08:09:58 +0000 (13 09:09 +0100) | ||
| committer | Markus Armbruster <armbru@redhat.com> | |
| Wed, 3 Feb 2016 09:13:06 +0000 (3 10:13 +0100) | ||
| tree | 57ccddbc02a6c706c89ff44f78ee62f65f9d397c | treesnapshot (tar.gz zip) |
| parent | c65db7705b7926f4a084b93778e4bd5dd3990aad | commitdiff |
hmp: fix sendkey out of bounds write (CVE-2015-8619)
When processing 'sendkey' command, hmp_sendkey routine null
terminates the 'keyname_buf' array. This results in an OOB
write issue, if 'keyname_len' was to fall outside of
'keyname_buf' array.
Since the keyname's length is known the keyname_buf can be
removed altogether by adding a length parameter to
index_from_key() and using it for the error output as well.
Reported-by: Ling Liu <liuling-it@360.cn>
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Message-Id: <20160113080958.GA18934@olga>
[Comparison with "<" dumbed down, test for junk after strtoul()
tweaked]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
When processing 'sendkey' command, hmp_sendkey routine null
terminates the 'keyname_buf' array. This results in an OOB
write issue, if 'keyname_len' was to fall outside of
'keyname_buf' array.
Since the keyname's length is known the keyname_buf can be
removed altogether by adding a length parameter to
index_from_key() and using it for the error output as well.
Reported-by: Ling Liu <liuling-it@360.cn>
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Message-Id: <20160113080958.GA18934@olga>
[Comparison with "<" dumbed down, test for junk after strtoul()
tweaked]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
| hmp.c | diffblobblamehistory | |
| include/ui/console.h | diffblobblamehistory | |
| ui/input-legacy.c | diffblobblamehistory |