From nobody Mon May 31 09:06:59 2021 X-Original-To: bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 6670CDF3FDC for ; Mon, 31 May 2021 09:06:59 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FtqDM26fzz4SmD for ; Mon, 31 May 2021 09:06:59 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 3026157A8 for ; Mon, 31 May 2021 09:06:59 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 14V96xUJ021340 for ; Mon, 31 May 2021 09:06:59 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 14V96x2d021339 for bugs@FreeBSD.org; Mon, 31 May 2021 09:06:59 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 256283] FreeBSD-SA-21:12.libradius breaks mpd5 when using MS-CHAPv2 Date: Mon, 31 May 2021 09:06:59 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 13.0-RELEASE X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: topical@gmx.net X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-bugs@freebsd.org MIME-Version: 1.0 X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D256283 --- Comment #1 from topical --- The CVE fix broke the following function: int rad_get_attr(struct rad_handle *h, const void **value, size_t *lenp) { int len, type; if (h->in_pos >=3D h->in_len) return 0; if (h->in_pos + 2 > h->in_len) { generr(h, "Malformed attribute in response"); return -1; } type =3D h->in[h->in_pos++]; len =3D h->in[h->in_pos++]; if (len < 2 || h->in_pos + len > h->in_len) { generr(h, "Malformed attribute in response"); return -1; } *lenp =3D len; *value =3D &h->in[h->in_pos]; h->in_pos +=3D len; return type; } The failure occurs after len =3D h->in[h->in_pos++]; This len is the total length of the attribute, **including** the 2 byte hea= der. All lines below assume that len excludes the header, so lenp is 2 byte too = long and h->in_pos is shifted 2 bytes too far.=20 When you call rad_get_attr() for the first time, the returned data is just 2 bytes to long (unless there is only 1 attribute, in which case you get a "Malformed attribute" error because of the "missing" 2 extra bytes). But: as h->in_pos is located 2 bytes within the second attribute on return, all subsequent calls to rad_get_attr() will return garbage. A possible fix is: int rad_get_attr(struct rad_handle *h, const void **value, size_t *lenp) { int len, type; if (h->in_pos >=3D h->in_len) return 0; if (h->in_pos + 2 > h->in_len) { generr(h, "Malformed attribute in response"); return -1; } type =3D h->in[h->in_pos]; len =3D h->in[h->in_pos + 1]; if (len < 2 || h->in_pos + len > h->in_len) { generr(h, "Malformed attribute in response"); return -1; } *lenp =3D len - 2; *value =3D &h->in[h->in_pos + 2]; h->in_pos +=3D len; return type; } The missing piece is: how to properly distribute this fix of the broken CVE fix? --=20 You are receiving this mail because: You are the assignee for the bug.=