romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-30 05:18:08 +03:00
Code Issues Projects Releases Packages Wiki Activity

socks: return error if hostname too long for remote resolve

Browse source 
Prior to this change the state machine attempted to change the remote
resolve to a local resolve if the hostname was longer than 255
characters. Unfortunately that did not work as intended and caused a
security issue.

Bug: https://curl.se/docs/CVE-2023-38545.html
This commit is contained in:
Jay Satiro 2023-10-11 07:34:19 +02:00 • committed by Daniel Stenberg
parent 09e25b9d94
commit fb4415d8ae
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 69 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/socks.c
View file

@ -587,9 +587,9 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
/* RFC1928 chapter 5 specifies max 255 chars for domain name in packet */
if(!socks5_resolve_local && hostname_len > 255) {
infof(data, "SOCKS5: server resolving disabled for hostnames of "
"length > 255 [actual len=%zu]", hostname_len);
socks5_resolve_local = TRUE;
failf(data, "SOCKS5: the destination hostname is too long to be "
"resolved remotely by the proxy.");
return CURLPX_LONG_HOSTNAME;
}
if(auth & ~(CURLAUTH_BASIC | CURLAUTH_GSSAPI))
@ -903,7 +903,7 @@ CONNECT_RESOLVE_REMOTE:
}
else {
socksreq[len++] = 3;
socksreq[len++] = (char) hostname_len; /* one byte address length */
socksreq[len++] = (unsigned char) hostname_len; /* one byte length */
memcpy(&socksreq[len], sx->hostname, hostname_len); /* w/o NULL */
len += hostname_len;
}