| [Date Prev] [Date Next] | [Thread Prev] [Thread Next] | [Date Index] [Thread Index] |
portmon buffer overflow in 4.2.2beta2
|
Hi folks,
New to the list, been using Nocol for a little over a year...
I believe I've located a bug in portmon.c. I've been monitoring http
servers with portmon; some of these are set up by customers rather than
by us, so we can't be sure of getting valid HTML back. The
configuration is something like:
HOST somehost 1.2.3.4 HTTP 80 Critical GET / HTTP/1.0\n
info <HEAD>
info <Head>
info <head>
info <BODY
info <Body
info <body
info 200 OK
since not all the httpds in use return a 200. (Growl, growl, but that's
not a Nocol problem.)
However, some of the top-level pages return a packet longer than the
2048 bytes that's the default buffer size in process_host. While the
buffer read is length-limited, it looks as if the end bytes may not be
set correctly in this case. Portmon was crashing with segmentation
faults, at any rate.
I've applied this patch to timeout_read, which seems to prevent the
problem (though I confess it's a bit ugly). Any more experienced Nocol
people care to comment?
--- portmon.old
+++ portmon.c
@@ -474,11 +474,12 @@
* Returns the number of bytes read.
* Returns -2 if timed out . Returns -1 if error occured
*/
-timeout_read(sock, buf, bufsiz, timeout)
+timeout_read(sock, buf, xbufsiz, timeout)
int sock;
char *buf;
- int bufsiz, timeout ;
+ int xbufsiz, timeout ;
{
+ int bufsiz=xbufsiz-4;
int n, len = bufsiz ;
char *cp;
fd_set fdvar;
As a separate issue, the nocollib.pl in the download package doesn't
have the required "return 1;" at the end that makes it work...
Roger
--
Roger Burton West roger@firedrake.org
ACTING IN A PRIVATE CAPACITY
Network Operations Centre Team Leader Direct Connection
|