[Sec 2667] buffer overflow in crypto_recv()

bk: 548acc4dN1TbM1tRJrbPcA4yc1aTdA

diff --git a/ChangeLog b/ChangeLog
index b21dae7d4747bf6f24bc9ce713b893b3b94c2dce..4ae917c14d796de2150d80185af37b20e9227d0e 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,4 @@
+* [Sec 2667] buffer overflow in crypto_recv().
 * [Bug 2686] refclock_gpsdjson needs strtoll(), which is not always present.
 (4.2.7p484-RC) 2014/12/11 Released by Harlan Stenn <stenn@ntp.org>
 (4.2.7p483) 2014/12/08 Released by Harlan Stenn <stenn@ntp.org>

diff --git a/ntpd/ntp_crypto.c b/ntpd/ntp_crypto.c
index e66d5c782ba8cefda63d797373e5e156644a9ad4..08a1c9f2bcd112aec8b234d8bf5e3eb0ee1c63d1 100644 (file)
--- a/ntpd/ntp_crypto.c
+++ b/ntpd/ntp_crypto.c
@@ -820,15 +820,24 @@ crypto_recv(
                         * errors.
                         */
                        if (vallen == (u_int)EVP_PKEY_size(host_pkey)) {
+                               u_int32 *cookiebuf = malloc(
+                                   RSA_size(host_pkey->pkey.rsa));
+                               if (!cookiebuf) {
+                                       rval = XEVNT_CKY;
+                                       break;
+                               }
+
                                if (RSA_private_decrypt(vallen,
                                    (u_char *)ep->pkt,
-                                   (u_char *)&temp32,
+                                   (u_char *)cookiebuf,
                                    host_pkey->pkey.rsa,
-                                   RSA_PKCS1_OAEP_PADDING) <= 0) {
+                                   RSA_PKCS1_OAEP_PADDING) != 4) {
                                        rval = XEVNT_CKY;
+                                       free(cookiebuf);
                                        break;
                                } else {
-                                       cookie = ntohl(temp32);
+                                       cookie = ntohl(*cookiebuf);
+                                       free(cookiebuf);
                                }
                        } else {
                                rval = XEVNT_CKY;