mirror/openvpn
0
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2024-09-20 03:52:28 +02:00
Code

Use stricter snprintf() formatting in socks_username_password_auth() (v3)

Browse Source 
commit fc1fa9ffc7 added a new function which needs to have a
stricter string formatting.  This was detected due to a compiler warning.

This patch makes sure that the length of username and password is not longer
than 255 bytes.  It also adds extra checks to avoid NULL pointer issues with
strlen() on these two parameters.

Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
Acked-by: Gert Doering <gert@greenie.muc.de>
This commit is contained in:
David Sommerseth 2010-11-15 21:44:59 +01:00
parent 6af422162f
commit 2ff54d66a2
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
socks.c
View File

@ -112,10 +112,17 @@ socks_username_password_auth (struct socks_proxy_info *p,
ssize_t size;
creds.defined = 0;
get_user_pass (&creds, p->authfile, UP_TYPE_SOCKS, GET_USER_PASS_MANAGEMENT);
snprintf (to_send, sizeof (to_send), "\x01%c%s%c%s", strlen(creds.username),
creds.username, strlen(creds.password), creds.password);
if( !creds.username || (strlen(creds.username) > 255)
|| !creds.password || (strlen(creds.password) > 255) ) {
msg (M_NONFATAL,
"SOCKS username and/or password exceeds 255 characters. "
"Authentication not possible.");
return false;
}
snprintf (to_send, sizeof (to_send), "\x01%c%s%c%s", (int) strlen(creds.username),
creds.username, (int) strlen(creds.password), creds.password);
size = send (sd, to_send, strlen(to_send), MSG_NOSIGNAL);
if (size != strlen (to_send))