[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20160928061236.BC79DABC200@smtpvmsrv1.mitre.org>
Date: Wed, 28 Sep 2016 02:12:36 -0400 (EDT)
From: cve-assign@...re.org
To: renorobert@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request - OpenSLP 2.0 Memory Corruption
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> The following commit fixes a memory corruption bug that I reported in OpenSLP:
>
> https://sourceforge.net/p/openslp/mercurial/ci/34fb3aa5e6b4997fa21cb614e480de36da5dbc9a/
>
> Below are the details of the issue:
>
> static int SLPFoldWhiteSpace(size_t len, char * str)
> {
> char * p = str, * ep = str + len;
> while (p < ep)
> {
> if (isspace(*p))
> {
> char * ws2p = ++p;
> while (isspace(*p))
> p++;
> len -= p - ws2p;
> memmove(ws2p, p, ep - p);
>
> The outer while loop checks for p < ep, but lack of bound check in
> inner while loop could result in p > ep. This will result in passing a
> very large 'size_t len' (ep - p) parameter for memmove().
>> Bug 151: Fix memory corruption due to possible overflow in SLPFoldWhiteSpace
>> common/slp_compare.c
Use CVE-2016-7567.
- --
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJX617/AAoJEHb/MwWLVhi2UX8QAKBc9RSARlbHWcJyRKjGgota
RA7gbhguRpArlE9nNw3sg17gSFXeP9YbekIVcGbPHkzZsa8rjg/UuAJzJAUjIsWA
ttclyg+in1HUdq52wHViKkZNIdIzn5UsEPqd3XZICDjq+bFr1ZXr/PUXUeJ+erbm
dyf6mcII7RRGUwSG/wmhQmFsKnDKBaLkYdQ1+nywoLDpRpCHsR+FvQcMsv0cUPrh
Tupd1e+u/Th2U7X/qc3Gx4OqVzBpfLgZxT25XlOZtBgRQiXnFMnkpN40lCr5RiTh
eFuJFrajC7tVDQsz7x2zrZq45zwi2346XjpCW77H6NXehVCAjC2hkEUPAjW/iN0S
JDB9ZwiCEjMbfj/FV+7lxwfJY4jF1jMToeMnjkWQvxa4cswKaRzW4f7ozK4bdrXf
B2aQoU8V9Wv3raDue2vffZ+2gcZ8i6G4yUeCj0A5M6IR5Ns13cnozXggdEz3M0Qw
8jH5UTWUO5W79gydhdh6tk3PKN2e/zpLH/9iSMPLSw6fjCfVdN6lQMlEhv2SkSeJ
jA6Ba1JtzoWeccQ9moCKu+sknXsDL254ZTjY/e0MpELhO1T+MrIsY6byj5HcnElL
hW48Yjxk0BrEKG44DkAXY6MoRaY9ATjG2mE0RI6uHUARYcAQEDYqvt8PUm1hr/pD
SbxziiqDfsNC77qcjZbm
=S1u7
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
