Menu

#70 buffer overflows break SS5_SRV and cgi functions

pending
nobody
None
5
2013-02-22
2012-06-26
No

src/SS5Core.c:
UINT ListOption( UINT s)
char buf[130];
snprintf(buf,sizeof(buf) - 1,"%64s\n%64s\n","SS5_ROLE_SLAVE","0" );

src/SS5Srv.c:
int List_Option( char *addr, UINT port, FILE *ou )
char option[32],value[64],resp[130];
sscanf(resp,"%64s\n%64s\n",option,value);

modules/mod_bandwidth/SS5Mod_bandwidth.c:
INT SrvBandwidth( struct _SS5ClientInfo *ci, struct _SS5Socks5Data *sd )
char usr[64], srvResponse[133]="\0";
S5BrowseBandTable(srvResponse,S5BandTableList[count]);

UINT S5BrowseBandTable( char *buf, struct _S5BandTableNode *node )
snprintf(buf,133 - 1,"%64s\n%16u\n%16lu\n%16u\n%16u\n",lnode->Usr,lnode->LNCon,lnode->LBand,lnode->NCon,lnode->STime);

Discussion

  • Matteo Ricchetti

    Try to fix in next release.

     
  • Matteo Ricchetti

    • status: open --> pending
     

Log in to post a comment.

Monday.com Logo