File net-snmp-5.6.1-fix-array-index-error.patch of Package net-snmp.507

Overview Repositories Revisions Requests Users Attributes Meta

File net-snmp-5.6.1-fix-array-index-error.patch of Package net-snmp.507

commit 4c5633f1603e4bd03ed05c37d782ec8911759c47
Author: Robert Story <rstory@freesnmp.com>
Date:   Mon May 14 11:40:06 2012 -0400

NEWS: snmp: BUG: 3526549: CVE-2012-2141 Array index error leading to crash

Index: net-snmp-5.6.1/agent/mibgroup/agent/extend.c
===================================================================
--- net-snmp-5.6.1.orig/agent/mibgroup/agent/extend.c
+++ net-snmp-5.6.1/agent/mibgroup/agent/extend.c
@@ -1138,7 +1138,7 @@ _extend_find_entry( netsnmp_request_info
              * ...and check the line requested is valid
              */
             line_idx = *table_info->indexes->next_variable->val.integer;
-            if (eptr->numlines < line_idx)
+            if (line_idx < 1 || line_idx > eptr->numlines)
                 return NULL;
         }
     }
@@ -1309,6 +1309,10 @@ handle_nsExtendOutput2Table(netsnmp_mib_
                  * Determine which line we've been asked for....
                  */
                 line_idx = *table_info->indexes->next_variable->val.integer;
+                if (line_idx < 1 || line_idx > extension->numlines) {
+                    netsnmp_set_request_error(reqinfo, request, SNMP_NOSUCHINSTANCE);
+                    continue;
+                }
                 cp  = extension->lines[line_idx-1];
 
                 /*

Places

File net-snmp-5.6.1-fix-array-index-error.patch of Package net-snmp.507

Places