j3d1/tinc
1
0
Fork 0
Code Issues 1 Pull requests Releases Wiki Activity

Drop packets forwarded via TCP if they are too big (CVE-2013-1428).

Browse source 
Normally all requests sent via the meta connections are checked so that they
cannot be larger than the input buffer. However, when packets are forwarded via
meta connections, they are copied into a packet buffer without checking whether
it fits into it. Since the packet buffer is allocated on the stack, this in
effect allows an authenticated remote node to cause a stack overflow.

This issue was found by Martin Schobert.
This commit is contained in:
Guus Sliepen 2013-04-12 17:15:05 +02:00
parent 9e2ae03d1d
commit 258bf7ea0f
4 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
src/net.h
View file

@ -135,6 +135,7 @@ extern int udp_sndbuf;
extern bool do_prune;
extern char *myport;
extern int autoconnect;
extern bool disablebuggypeers;
extern int contradicting_add_edge;
extern int contradicting_del_edge;
extern time_t last_config_check;