Changeset 651988747506d25414e2375c0eb1b41f0ca3aaf9

Show
Ignore:
Timestamp:
06/27/12 18:09:05 (2 years ago)
Author:
Theo Schlossnagle <jesus@omniti.com>
git-committer:
Theo Schlossnagle <jesus@omniti.com> 1340820545 -0400
git-parent:

[9032e5d456a621f93ed59e03c9fbaea9f64454b0]

git-author:
Russell Haering <russell.haering@rackspace.com> 1340820545 -0400
Message:

Various security fixes.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved
  • src/modules/snmp.c

    r4496cc4 r6519887  
    439439   */ 
    440440  if(template_v1pdu->trap_type == SNMP_TRAP_ENTERPRISESPECIFIC) { 
     441    if(template_v1pdu->enterprise_length + 2 > MAX_OID_LEN) { 
     442      noitL(nlerr, "send_trap: enterprise_length too large\n"); 
     443      snmp_free_pdu(template_v2pdu); 
     444      return NULL; 
     445    } 
    441446    memcpy(enterprise, template_v1pdu->enterprise, 
    442447           template_v1pdu->enterprise_length*sizeof(oid)); 
  • src/udns/udns_dn.c

    r2420d0a r6519887  
    2727unsigned dns_dnlen(dnscc_t *dn) { 
    2828  register dnscc_t *d = dn; 
    29   while(*d) 
     29  unsigned l = 0; 
     30  while(*d && l < DNS_MAXDN) { 
     31    l += 1 + *d; 
    3032    d += 1 + *d; 
     33  } 
    3134  return (unsigned)(d - dn) + 1; 
    3235} 
     
    136139    return -1;                          /* label too long */ 
    137140  if ((llab[-1] = (dnsc_t)c) != 0) { 
     141    if (dp >= de) 
     142      return -1; 
    138143    *dp++ = 0; 
    139144    if (isabs) 
  • src/udns/udns_parse.c

    r5a9b91b r6519887  
    5656    c = *pp++;                  /* length of the label */ 
    5757    if (!c) {                   /* empty label: terminate */ 
    58       if (dn >= de)           /* can't fit terminator */ 
     58      if (dp >= de)           /* can't fit terminator */ 
    5959        goto noroom; 
    6060      *dp++ = 0; 
  • src/yajl-lib/yajl_parser.c

    rbd6d64f r6519887  
    125125            } 
    126126        } 
    127         assert(i <= 71); 
     127        assert(i <= 70); 
    128128        text[i++] = '\n'; 
    129129        text[i] = 0;