albino
/
ngircd-tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Correctly handle return code of Handle_Write() 

There have been code paths that ignored the return code of Handle_Write()
when sending "notice auth" messages to new clients connecting to the
server. But because Handle_Write() would have closed the client connection
again if an error occurred, this would have resulted in new errors and
assert()'s later on that could have crashed the server (denial of service).

Only setups having the configuration option "NoticeAuth" enabled are
affected, which is not the default.

CVE-2013-5580.
This commit is contained in:
Alexander Barton 2013-08-21 01:28:49 +02:00
parent 8f530eb315
commit 309122017e
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/ngircd/conn.c
View File

@ -1668,7 +1668,11 @@ Conn_StartLogin(CONN_ID Idx)
#endif
(void)Conn_WriteStr(Idx,
"NOTICE AUTH :*** Looking up your hostname");
(void)Handle_Write(Idx);
/* Send buffered data to the client, but break on errors
* because Handle_Write() would have closed the connection
* again in this case! */
if (!Handle_Write(Idx))
return;
}
Resolve_Addr(&My_Connections[Idx].proc_stat, &My_Connections[Idx].addr,
@ -2458,8 +2462,13 @@ cb_Read_Resolver_Result( int r_fd, UNUSED short events )
}
#endif
if (Conf_NoticeAuth)
(void)Handle_Write(i);
if (Conf_NoticeAuth) {
/* Send buffered data to the client, but break on
* errors because Handle_Write() would have closed
* the connection again in this case! */
if (!Handle_Write(i))
return;
}
Class_HandleServerBans(c);
}