daemon: enforce limits when receiving arbitrary-length data in privsep

diff --git a/src/daemon/priv-linux.c b/src/daemon/priv-linux.c
index 315faf3eef6bd287b14a46a4905f2d7c836e9b13..37865235cec698c3a0e44bba490bd7d4e572c71e 100644 (file)
--- a/src/daemon/priv-linux.c
+++ b/src/daemon/priv-linux.c
@@ -21,6 +21,7 @@
 #include <inttypes.h>
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <limits.h>
 #include <fcntl.h>
 #include <errno.h>
 #include <regex.h>
@@ -81,6 +82,8 @@ asroot_open()
        regex_t preg;
 
        must_read(PRIV_PRIVILEGED, &len, sizeof(len));
+       if (len < 0 || len > PATH_MAX)
+               fatalx("privsep", "too large value requested");
        if ((file = (char *)malloc(len + 1)) == NULL)
                fatal("privsep", NULL);
        must_read(PRIV_PRIVILEGED, file, len);

diff --git a/src/daemon/priv.c b/src/daemon/priv.c
index 1c36212163a68a6b60a6c2e3ecb2f36ad6cceac5..08b5861984ccdf946fbecfcbf8175a195d957e7b 100644 (file)
--- a/src/daemon/priv.c
+++ b/src/daemon/priv.c
@@ -106,15 +106,17 @@ char *
 priv_gethostname()
 {
        static char *buf = NULL;
-       int rc;
+       int len;
        enum priv_cmd cmd = PRIV_GET_HOSTNAME;
        must_write(PRIV_UNPRIVILEGED, &cmd, sizeof(enum priv_cmd));
        priv_wait();
-       must_read(PRIV_UNPRIVILEGED, &rc, sizeof(int));
-       if ((buf = (char*)realloc(buf, rc+1)) == NULL)
+       must_read(PRIV_UNPRIVILEGED, &len, sizeof(int));
+       if (len < 0 || len > 255)
+               fatalx("privsep", "too large value requested");
+       if ((buf = (char*)realloc(buf, len+1)) == NULL)
                fatal("privsep", NULL);
-       must_read(PRIV_UNPRIVILEGED, buf, rc);
-       buf[rc] = '\0';
+       must_read(PRIV_UNPRIVILEGED, buf, len);
+       buf[len] = '\0';
        return buf;
 }
 
@@ -205,6 +207,8 @@ asroot_ctl_cleanup()
        int rc = 0;
 
        must_read(PRIV_PRIVILEGED, &len, sizeof(int));
+       if (len < 0 || len > PATH_MAX)
+               fatalx("privsep", "too large value requested");
        if ((ctlname = (char*)malloc(len+1)) == NULL)
                fatal("privsep", NULL);
 
@@ -310,6 +314,8 @@ asroot_iface_description()
        must_read(PRIV_PRIVILEGED, &name, sizeof(name));
        name[sizeof(name) - 1] = '\0';
        must_read(PRIV_PRIVILEGED, &len, sizeof(int));
+       if (len < 0 || len > PATH_MAX)
+               fatalx("privsep", "too large value requested");
        if ((description = (char*)malloc(len+1)) == NULL)
                fatal("privsep", NULL);