[Sec 3377] NTP-01-002 Buffer Overflow in ntpq when fetching reslist

bk: 589f58574daOkdmCkyXNpBeidQfotw

diff --git a/ChangeLog b/ChangeLog
index 595a3d77629ef0c056a6c4fb26f723863cf7d42e..8fe0e49601709171689086d9b5de66cc179ad910 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+---
+* [Sec 3377] NTP-01-002 Buffer Overflow in ntpq when fetching reslist
+  (Pentest report 01.2017) <perlinger@ntp.org
+
 ---
 (4.2.8p9-win) 2017/02/01 Released by Harlan Stenn <stenn@ntp.org>
 

diff --git a/ntpq/ntpq-subs.c b/ntpq/ntpq-subs.c
index 35caee22328168fa77a248601f908ba0b6022d83..08f9d426a4a476c15ff0d9c250414c48e0e8d650 100644 (file)
--- a/ntpq/ntpq-subs.c
+++ b/ntpq/ntpq-subs.c
@@ -3614,11 +3614,13 @@ reslist(
                                if (NULL == val) {
                                        row.flagstr[0] = '\0';
                                        comprende = TRUE;
-                               } else {
-                                       len = strlen(val);
+                               } else if ((len = strlen(val)) < sizeof(row.flagstr)) {
                                        memcpy(row.flagstr, val, len);
                                        row.flagstr[len] = '\0';
                                        comprende = TRUE;
+                               } else {
+                                        /* no flags, and still !comprende */
+                                       row.flagstr[0] = '\0';
                                }
                        }
                        break;