From: Tobias Brunner <tobias@strongswan.org>
Date: Fri, 29 Nov 2013 16:42:11 +0000 (+0100)
Subject: stroke: Ensure the buffer of strings in a stroke_msg_t is null-terminated
X-Git-Tag: 5.1.2rc1~47
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f44b1eb4447085cff350bcd89dbcd080347b91f8;p=thirdparty%2Fstrongswan.git

stroke: Ensure the buffer of strings in a stroke_msg_t is null-terminated

Otherwise a malicious user could send an unterminated string to cause
unterminated reads.
---

diff --git a/src/libcharon/plugins/stroke/stroke_socket.c b/src/libcharon/plugins/stroke/stroke_socket.c
index 8c0f2ea7b6..1f6ef6bf14 100644
--- a/src/libcharon/plugins/stroke/stroke_socket.c
+++ b/src/libcharon/plugins/stroke/stroke_socket.c
@@ -623,8 +623,8 @@ static bool on_accept(private_stroke_socket_t *this, stream_t *stream)
 		return FALSE;
 	}
 
-	/* read message */
-	msg = malloc(len);
+	/* read message (we need an additional byte to terminate the buffer) */
+	msg = malloc(len + 1);
 	msg->length = len;
 	if (!stream->read_all(stream, (char*)msg + sizeof(len), len - sizeof(len)))
 	{
@@ -635,6 +635,9 @@ static bool on_accept(private_stroke_socket_t *this, stream_t *stream)
 		free(msg);
 		return FALSE;
 	}
+	/* make sure even incorrectly unterminated strings don't extend over the
+	 * message boundaries */
+	((char*)msg)[len] = '\0';
 
 	DBG3(DBG_CFG, "stroke message %b", (void*)msg, len);