From: Antonio Quartulli Date: Wed, 21 Apr 2021 23:49:08 +0000 (+0200) Subject: options: check for blanks in fingerprints and reject string if found X-Git-Tag: v2.6_beta1~529 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9e71cf13134c10bb7e952e3dadbcc79884f60b93;p=thirdparty%2Fopenvpn.git options: check for blanks in fingerprints and reject string if found A fingerprint is not expected to contains any blank (white space), however, the parser routine will still attempt parsing the octect and ignore the space. This means that a fingerprint like "5 :F0: 8:75:70:46:6E:(...)" will be parsed successfully. Explicitly check for spaces in the various octets, before conversion, and error out if any is found. Signed-off-by: Antonio Quartulli Acked-by: Arne Schwabe Message-Id: <20210421234908.12817-1-a@unstable.cc> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22182.html Signed-off-by: Gert Doering --- diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 84da0456e..2a5b1393e 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -1101,6 +1101,18 @@ parse_hash_fingerprint(const char *str, int nbytes, int msglevel, struct gc_aren bs[0] = *cp++; bs[1] = *cp++; bs[2] = 0; + + /* the format string "%x" passed to sscanf will ignore any space and + * will still try to parse the other character. However, this is not + * expected format for a fingerprint, therefore explictly check for + * blanks in the string and error out if any is found + */ + if (bs[0] == ' ' || bs[1] == ' ') + { + msg(msglevel, "format error in hash fingerprint unexpected blank: %s", + str); + } + byte = 0; if (sscanf(bs, "%x", &byte) != 1) {