shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-09 09:54:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2023-6004: config_parser: Check for valid syntax of a hostname if it is a domain name

Browse Source 
This prevents code injection.
The domain name syntax checker is based on RFC1035.

Signed-off-by: Norbert Pocs <norbertpocs0@gmail.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
This commit is contained in:
Norbert Pocs
2023-10-10 18:33:56 +02:00
committed by Andreas Schneider
parent 2cd971e10e
commit 95c6f880ef
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/config_parser.c
View File

@@ -30,6 +30,7 @@
#include "libssh/config_parser.h" #include "libssh/config_parser.h"
#include "libssh/priv.h" #include "libssh/priv.h"
#include "libssh/misc.h"
/* Returns the original string after skipping the leading whitespace /* Returns the original string after skipping the leading whitespace
* until finding LF. * until finding LF.
@@ -47,7 +48,7 @@ char *ssh_config_get_cmd(char **str)
break; break;
} }
} }
for (r = c; *c; c++) { for (r = c; *c; c++) {
if (*c == '\n') { if (*c == '\n') {
*c = '\0'; *c = '\0';
@@ -167,6 +168,7 @@ int ssh_config_parse_uri(const char *tok,
{ {
char *endp = NULL; char *endp = NULL;
long port_n; long port_n;
int rc;
/* Sanitize inputs */ /* Sanitize inputs */
if (username != NULL) { if (username != NULL) {
@@ -224,6 +226,14 @@ int ssh_config_parse_uri(const char *tok,
if (*hostname == NULL) { if (*hostname == NULL) {
goto error; goto error;
} }
/* if not an ip, check syntax */
rc = ssh_is_ipaddr(*hostname);
if (rc == 0) {
rc = ssh_check_hostname_syntax(*hostname);
if (rc != SSH_OK) {
goto error;
}
}
} }
/* Skip also the closing bracket */ /* Skip also the closing bracket */
if (*endp == ']') { if (*endp == ']') {