From c10d1dbf9b8a08c22c5aae88fb92f9a282fe1120 Mon Sep 17 00:00:00 2001 From: Artur Byszko Date: Wed, 13 Aug 2003 01:33:02 +0000 Subject: [PATCH] fix buffer overflow vulnerability in NetGenFunc --- README | 6 ++++++ inet.c | 3 +++ 2 files changed, 9 insertions(+) diff --git a/README b/README index 9420e20..9b1886a 100644 --- a/README +++ b/README @@ -51,6 +51,12 @@ how it goes, and send me diffs if needed! See the FAQ in this directory if you have any problems. +FIXED IN VERSION 0.52 +===================== +Fixed a buffer overflow vulnerability discovered by +Artur Byszko / bajkero + + NEW IN VERSION 0.5 ================== Netris now specifically looks for ncurses and uses color if it's diff --git a/inet.c b/inet.c index dbfe748..a8d9a9d 100644 --- a/inet.c +++ b/inet.c @@ -151,6 +151,9 @@ static MyEventType NetGenFunc(EventGenRec *gen, MyEvent *event) memcpy(data, netBuf, sizeof(data)); type = ntoh2(data[0]); size = ntoh2(data[1]); + if (size >= sizeof(netBuf)) + fatal("Received an invalid packet (too large), possibly an attempt\n" + " to exploit a vulnerability in versions before 0.52 !"); netBufGoal = size; if (netBufSize < netBufGoal) return E_none; -- 2.30.0