isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Check for sudo_pow2_roundup() overflow.

Browse Source 
Calling sudo_pow2_roundup(INT_MAX+2) will return since there is no
power of 2 larger than INT_MAX+1 that fits in an unsigned int.
This is not an issue in practice since we restrict messages to 2Mib.
This commit is contained in:
Todd C. Miller
2023-03-01 13:58:32 -07:00
parent 19a660612f
commit b013711e48
5 changed files with 69 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
logsrvd/logsrv_util.c
View File

@@ -62,18 +62,21 @@ expand_buf(struct connection_buffer *buf, unsigned int needed)
if (buf->size < needed) {
/* Expand buffer. */
needed = sudo_pow2_roundup(needed);
const unsigned int newsize = sudo_pow2_roundup(needed);
sudo_debug_printf(SUDO_DEBUG_INFO|SUDO_DEBUG_LINENO,
"expanding buffer from %u to %u", buf->size, needed);
if ((newdata = malloc(needed)) == NULL) {
sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
debug_return_bool(false);
"expanding buffer from %u to %u", buf->size, newsize);
if (newsize < needed) {
/* overflow */
errno = ENOMEM;
goto oom;
}
if ((newdata = malloc(newsize)) == NULL)
goto oom;
if (buf->len != buf->off)
memcpy(newdata, buf->data + buf->off, buf->len - buf->off);
free(buf->data);
buf->data = newdata;
buf->size = needed;
buf->size = newsize;
} else {
/* Just reset existing buffer. */
if (buf->len != buf->off) {
@@ -85,6 +88,9 @@ expand_buf(struct connection_buffer *buf, unsigned int needed)
buf->off = 0;
debug_return_bool(true);
oom:
sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
debug_return_bool(false);
}
/*