Mirrors_Framework/mosquitto
1
0
Fork 0
mirror of https://github.com/eclipse-mosquitto/mosquitto.git synced 2026-09-24 00:54:01 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix oss-fuzz 67481

Browse Source 
Memory overflow due to duplicate usernames and corrupt input parameters in
admin provided password file, hence local only issue.
This commit is contained in:
Roger A. Light
2024-03-18 09:18:31 +00:00
parent b89ff3f923
commit 7aac727bbf
1 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/security_default.c
+16 -6
View File
@@ -741,18 +741,28 @@ static int pwfile__parse(const char *file, struct mosquitto__unpwd **root)
username = strtok_r(buf, ":", &saveptr);
if(username){
username = mosquitto_trimblanks(username);
if(strlen(username) > 65535){
log__printf(NULL, MOSQ_LOG_NOTICE, "Warning: Invalid line in password file '%s', username too long.", file);
continue;
}
if(strlen(username) <= 0){
log__printf(NULL, MOSQ_LOG_NOTICE, "Warning: Empty username in password file '%s', ingoring.", file);
continue;
}
HASH_FIND(hh, *root, username, strlen(username), unpwd);
if(unpwd){
log__printf(NULL, MOSQ_LOG_NOTICE, "Error: Duplicate user '%s' in password file '%s', ignoring.", username, file);
continue;
}
unpwd = mosquitto_calloc(1, sizeof(struct mosquitto__unpwd));
if(!unpwd){
fclose(pwfile);
mosquitto_FREE(buf);
return MOSQ_ERR_NOMEM;
}
username = mosquitto_trimblanks(username);
if(strlen(username) > 65535){
log__printf(NULL, MOSQ_LOG_NOTICE, "Warning: Invalid line in password file '%s', username too long.", file);
mosquitto_FREE(unpwd);
continue;
}
unpwd->username = mosquitto_strdup(username);
if(!unpwd->username){