Changeset 651988747506d25414e2375c0eb1b41f0ca3aaf9

Timestamp:

06/27/12 18:09:05 (1 year ago)

Author:

Theo Schlossnagle <jesus@omniti.com>

git-committer:

Theo Schlossnagle <jesus@omniti.com> 1340820545 -0400

git-parent:

[9032e5d456a621f93ed59e03c9fbaea9f64454b0]

git-author:

Russell Haering <russell.haering@rackspace.com> 1340820545 -0400

Message:

Various security fixes.

Files:

• src/modules/snmp.c (modified) (1 diff)
• src/udns/udns_dn.c (modified) (2 diffs)
• src/udns/udns_parse.c (modified) (1 diff)
• src/yajl-lib/yajl_parser.c (modified) (1 diff)

src/modules/snmp.c

@@ -439 +439 @@
-   */
-  if(template_v1pdu->trap_type == SNMP_TRAP_ENTERPRISESPECIFIC) {
+    if(template_v1pdu->enterprise_length + 2 > MAX_OID_LEN) {
+      noitL(nlerr, "send_trap: enterprise_length too large\n");
+      snmp_free_pdu(template_v2pdu);
+      return NULL;
+    }
-    memcpy(enterprise, template_v1pdu->enterprise,
-           template_v1pdu->enterprise_length*sizeof(oid));

src/udns/udns_dn.c

@@ -27 +27 @@
-unsigned dns_dnlen(dnscc_t *dn) {
-  register dnscc_t *d = dn;
-
+
+
+
-    d += 1 + *d;
+  }
-  return (unsigned)(d - dn) + 1;
-}
@@ -136 +139 @@
-    return -1;                          /* label too long */
-  if ((llab[-1] = (dnsc_t)c) != 0) {
+    if (dp >= de)
+      return -1;
-    *dp++ = 0;
-    if (isabs)

src/udns/udns_parse.c

@@ -56 +56 @@
-    c = *pp++;                  /* length of the label */
-    if (!c) {                   /* empty label: terminate */
-n
+p
-        goto noroom;
-      *dp++ = 0;

src/yajl-lib/yajl_parser.c

@@ -125 +125 @@
-            }
-        }
-1
+0
-        text[i++] = '\n';
-        text[i] = 0;