httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From poir...@apache.org
Subject svn commit: r797563 - in /httpd/httpd/trunk: CHANGES support/htdbm.c
Date Fri, 24 Jul 2009 17:15:29 GMT
Author: poirier
Date: Fri Jul 24 17:15:29 2009
New Revision: 797563

URL: http://svn.apache.org/viewvc?rev=797563&view=rev
Log:
htdbm: Fix possible buffer overflow if dbm database has very
long values.  PR 30586 [Dan Poirier]

PR 30586
Reported by: Ulf Harnhammar, Swedish IT Incident Centre

Modified:
    httpd/httpd/trunk/CHANGES
    httpd/httpd/trunk/support/htdbm.c

Modified: httpd/httpd/trunk/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?rev=797563&r1=797562&r2=797563&view=diff
==============================================================================
--- httpd/httpd/trunk/CHANGES [utf-8] (original)
+++ httpd/httpd/trunk/CHANGES [utf-8] Fri Jul 24 17:15:29 2009
@@ -11,6 +11,9 @@
      mod_proxy_ajp: Avoid delivering content from a previous request which
      failed to send a request body. PR 46949 [Ruediger Pluem]
 
+  *) htdbm: Fix possible buffer overflow if dbm database has very
+     long values.  PR 30586 [Dan Poirier]
+
   *) core: Return APR_EOF if request body is shorter than the length announced
      by the client. PR 33098 [ Stefan Fritsch <sf sfritsch.de>]
 

Modified: httpd/httpd/trunk/support/htdbm.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/support/htdbm.c?rev=797563&r1=797562&r2=797563&view=diff
==============================================================================
--- httpd/httpd/trunk/support/htdbm.c (original)
+++ httpd/httpd/trunk/support/htdbm.c Fri Jul 24 17:15:29 2009
@@ -219,7 +219,7 @@
 static apr_status_t htdbm_verify(htdbm_t *htdbm)
 {
     apr_datum_t key, val;
-    char pwd[MAX_STRING_LEN] = {0};
+    char *pwd;
     char *rec, *cmnt;
 
     key.dptr = htdbm->username;
@@ -231,9 +231,9 @@
     rec = apr_pstrndup(htdbm->pool, val.dptr, val.dsize);
     cmnt = strchr(rec, ':');
     if (cmnt)
-        strncpy(pwd, rec, cmnt - rec);
+        pwd = apr_pstrndup(htdbm->pool, rec, cmnt - rec);
     else
-        strcpy(pwd, rec);
+        pwd = apr_pstrdup(htdbm->pool, rec);
     return apr_password_validate(htdbm->userpass, pwd);
 }
 
@@ -242,7 +242,7 @@
     apr_status_t rv;
     apr_datum_t key, val;
     char *rec, *cmnt;
-    char kb[MAX_STRING_LEN];
+    char *kb;
     int i = 0;
 
     rv = apr_dbm_firstkey(htdbm->dbm, &key);
@@ -250,8 +250,6 @@
         fprintf(stderr, "Empty database -- %s\n", htdbm->filename);
         return APR_ENOENT;
     }
-    rec = apr_pcalloc(htdbm->pool, HUGE_STRING_LEN);
-
     fprintf(stderr, "Dumping records from database -- %s\n", htdbm->filename);
     fprintf(stderr, "    %-32sComment\n", "Username");
     while (key.dptr != NULL) {
@@ -260,11 +258,9 @@
             fprintf(stderr, "Failed getting data from %s\n", htdbm->filename);
             return APR_EGENERAL;
         }
-        strncpy(kb, key.dptr, key.dsize);
-        kb[key.dsize] = '\0';
+        kb = apr_pstrndup(htdbm->pool, key.dptr, key.dsize);
         fprintf(stderr, "    %-32s", kb);
-        strncpy(rec, val.dptr, val.dsize);
-        rec[val.dsize] = '\0';
+        rec = apr_pstrndup(htdbm->pool, val.dptr, val.dsize);
         cmnt = strchr(rec, ':');
         if (cmnt)
             fprintf(stderr, "%s", cmnt + 1);



Mime
View raw message