Attachment 1544 Details for Bug 1482 – correct patch

[patch] correct patch

socks4a.patch (text/plain), 2.56 KB, created by David Woodhouse on 2008-07-05 08:19:23 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: David Woodhouse

Created: 2008-07-05 08:19:23 AEST

Size: 2.56 KB

patch

obsolete

>--- openssh-5.0p1/channels.c~	2008-04-09 17:06:20.000000000 +0100
>+++ openssh-5.0p1/channels.c	2008-07-01 09:34:51.000000000 +0100
>@@ -1028,7 +1028,7 @@ static int
> channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset)
> {
> 	char *p, *host;
>-	u_int len, have, i, found;
>+	u_int len, have, i, found, need;
> 	char username[256];
> 	struct {
> 		u_int8_t version;
>@@ -1044,10 +1044,20 @@ channel_decode_socks4(Channel *c, fd_set
> 	if (have < len)
> 		return 0;
> 	p = buffer_ptr(&c->input);
>+
>+	need = 1;
>+	/* SOCKS4A uses an invalid IP address 0.0.0.x */
>+	if (!p[4] && !p[5] && !p[6] && p[7]) {
>+		debug2("channel %d: socks4a request", c->self);
>+		/* ... and needs an extra string (the hostname) */
>+		need = 2;
>+	}
>+	/* Check for terminating NUL on the string(s) */
> 	for (found = 0, i = len; i < have; i++) {
> 		if (p[i] == '\0') {
>-			found = 1;
>-			break;
>+			found++;
>+			if (found == need)
>+				break;
> 		}
> 		if (i > 1024) {
> 			/* the peer is probably sending garbage */
>@@ -1056,7 +1066,7 @@ channel_decode_socks4(Channel *c, fd_set
> 			return -1;
> 		}
> 	}
>-	if (!found)
>+	if (found < need)
> 		return 0;
> 	buffer_get(&c->input, (char *)&s4_req.version, 1);
> 	buffer_get(&c->input, (char *)&s4_req.command, 1);
>@@ -1066,19 +1076,33 @@ channel_decode_socks4(Channel *c, fd_set
> 	p = buffer_ptr(&c->input);
> 	len = strlen(p);
> 	debug2("channel %d: decode socks4: user %s/%d", c->self, p, len);
>+	len++;					/* trailing '\0' */
> 	if (len > have)
> 		fatal("channel %d: decode socks4: len %d > have %d",
> 		    c->self, len, have);
> 	strlcpy(username, p, sizeof(username));
> 	buffer_consume(&c->input, len);
>-	buffer_consume(&c->input, 1);		/* trailing '\0' */
> 
>-	host = inet_ntoa(s4_req.dest_addr);
>-	strlcpy(c->path, host, sizeof(c->path));
>+	if (need == 1) {			/* SOCKS4: one string */
>+		host = inet_ntoa(s4_req.dest_addr);
>+		strlcpy(c->path, host, sizeof(c->path));
>+	} else {				/* SOCKS4A: two strings */
>+		have = buffer_len(&c->input);
>+		p = buffer_ptr(&c->input);
>+		len = strlen(p);
>+		debug2("channel %d: decode socks4a: host %s/%d", c->self, p,
>+		       len);
>+		len++;				/* trailing '\0' */
>+		if (len > have)
>+			fatal("channel %d: decode socks4a: len %d > have %d",
>+			      c->self, len, have);
>+		strlcpy(c->path, p, sizeof(c->path));
>+		buffer_consume(&c->input, len);
>+	}
> 	c->host_port = ntohs(s4_req.dest_port);
> 
> 	debug2("channel %d: dynamic request: socks4 host %s port %u command %u",
>-	    c->self, host, c->host_port, s4_req.command);
>+	    c->self, c->path, c->host_port, s4_req.command);
> 
> 	if (s4_req.command != 1) {
> 		debug("channel %d: cannot handle: socks4 cn %d",

Actions: View | Diff

Attachments on bug 1482: 1543 | 1544