upstream commit

sanitise characters destined for xauth reported by
 github.com/tintinweb feedback and ok deraadt and markus

Upstream-ID: 18ad8d0d74cbd2ea3306a16595a306ee356aa261

diff --git a/session.c b/session.c
index 9a75c622ecf0e1251bc29d40513a9bdbee97644d..485924570750d1b03f22393c233e69b3b3930e27 100644 (file)
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.281 2016/03/07 19:02:43 djm Exp $ */
+/* $OpenBSD: session.c,v 1.282 2016/03/10 11:47:57 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -46,6 +46,7 @@
 
 #include <arpa/inet.h>
 
+#include <ctype.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <grp.h>
@@ -274,6 +275,21 @@ do_authenticated(Authctxt *authctxt)
        do_cleanup(authctxt);
 }
 
+/* Check untrusted xauth strings for metacharacters */
+static int
+xauth_valid_string(const char *s)
+{
+       size_t i;
+
+       for (i = 0; s[i] != '\0'; i++) {
+               if (!isalnum((u_char)s[i]) &&
+                   s[i] != '.' && s[i] != ':' && s[i] != '/' &&
+                   s[i] != '-' && s[i] != '_')
+               return 0;
+       }
+       return 1;
+}
+
 /*
  * Prepares for an interactive session.  This is called after the user has
  * been successfully authenticated.  During this message exchange, pseudo
@@ -347,7 +363,13 @@ do_authenticated1(Authctxt *authctxt)
                                s->screen = 0;
                        }
                        packet_check_eom();
-                       success = session_setup_x11fwd(s);
+                       if (xauth_valid_string(s->auth_proto) &&
+                           xauth_valid_string(s->auth_data))
+                               success = session_setup_x11fwd(s);
+                       else {
+                               success = 0;
+                               error("Invalid X11 forwarding data");
+                       }
                        if (!success) {
                                free(s->auth_proto);
                                free(s->auth_data);
@@ -2184,7 +2206,13 @@ session_x11_req(Session *s)
        s->screen = packet_get_int();
        packet_check_eom();
 
-       success = session_setup_x11fwd(s);
+       if (xauth_valid_string(s->auth_proto) &&
+           xauth_valid_string(s->auth_data))
+               success = session_setup_x11fwd(s);
+       else {
+               success = 0;
+               error("Invalid X11 forwarding data");
+       }
        if (!success) {
                free(s->auth_proto);
                free(s->auth_data);