2147. [bug] libbind: remove potential buffer overflow from

                        hmac_link.c. [RT #16437]

diff --git a/CHANGES b/CHANGES
index aebe8de6bea19ff57a9ee079eec4c5013cf1825f..dfbda09e567967c2416c5384e358728a4b9f97f1 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2147.  [bug]           libbind: remove potential buffer overflow from
+                       hmac_link.c. [RT #16437]
+
 2146.  [cleanup]       Silence Linux's spurious "obsolete setsockopt
                        SO_BSDCOMPAT" message. [RT #16641]
 

diff --git a/lib/bind/dst/hmac_link.c b/lib/bind/dst/hmac_link.c
index 562129975b5b06654bc7e1ee4f268bd3be3f9b5d..5cf4c400f7c6b82ce671d022eedcf0523180d301 100644 (file)
--- a/lib/bind/dst/hmac_link.c
+++ b/lib/bind/dst/hmac_link.c
@@ -1,6 +1,6 @@
 #ifdef HMAC_MD5
 #ifndef LINT
-static const char rcsid[] = "$Header: /u0/home/explorer/proj/ISC/git-conversion/cvsroot/bind9/lib/bind/dst/Attic/hmac_link.c,v 1.2.2.1.4.2 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Header: /u0/home/explorer/proj/ISC/git-conversion/cvsroot/bind9/lib/bind/dst/Attic/hmac_link.c,v 1.2.2.1.4.3 2007/02/26 02:00:26 marka Exp $";
 #endif
 /*
  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
@@ -273,16 +273,21 @@ dst_buffer_to_hmac_md5(DST_KEY *dkey, const u_char *key, const int keylen)
 
 static int
 dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff,
-                               const int buff_len)
+                               const int buff_len)
 {
        char *bp;
-       int len, b_len, i, key_len;
+       int len, i, key_len;
        u_char key[HMAC_LEN];
        HMAC_Key *hkey;
 
        if (dkey == NULL || dkey->dk_KEY_struct == NULL) 
                return (0);
-       if (buff == NULL || buff_len <= (int) strlen(key_file_fmt_str))
+       /*
+        * Using snprintf() would be so much simpler here.
+        */
+       if (buff == NULL ||
+           buff_len <= (int)(strlen(key_file_fmt_str) +
+                             strlen(KEY_FILE_FORMAT) + 4))
                return (-1);    /* no OR not enough space in output area */
 
        hkey = (HMAC_Key *) dkey->dk_KEY_struct;
@@ -291,7 +296,6 @@ dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff,
        sprintf(buff, key_file_fmt_str, KEY_FILE_FORMAT, KEY_HMAC_MD5, "HMAC");
 
        bp = buff + strlen(buff);
-       b_len = buff_len - (bp - buff);
 
        memset(key, 0, HMAC_LEN);
        for (i = 0; i < HMAC_LEN; i++)
@@ -301,19 +305,21 @@ dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff,
                        break;
        key_len = i + 1;
 
+       if (buff_len - (bp - buff) < 6)
+               return (-1);
        strcat(bp, "Key: ");
        bp += strlen("Key: ");
-       b_len = buff_len - (bp - buff);
 
-       len = b64_ntop(key, key_len, bp, b_len);
+       len = b64_ntop(key, key_len, bp, buff_len - (bp - buff));
        if (len < 0) 
                return (-1);
        bp += len;
+       if (buff_len - (bp - buff) < 2)
+               return (-1);
        *(bp++) = '\n';
        *bp = '\0';
-       b_len = buff_len - (bp - buff);
 
-       return (buff_len - b_len);
+       return (bp - buff);
 }