freeradius-server/freeradius-server-snprintf-overflow.patch

18 lines
723 B
Diff
Raw Normal View History

Index: freeradius-server-2.1.11/src/modules/rlm_mschap/rlm_mschap.c
===================================================================
--- freeradius-server-2.1.11.orig/src/modules/rlm_mschap/rlm_mschap.c
+++ freeradius-server-2.1.11/src/modules/rlm_mschap/rlm_mschap.c
@@ -1251,10 +1251,10 @@ static int mschap_authenticate(void * in
inst->allow_retry);
if (inst->retry_msg) {
- snprintf(buffer + 9, sizeof(buffer), " C=");
+ snprintf(buffer + 9, sizeof(buffer) - 9, " C=");
for (i = 0; i < 16; i++) {
snprintf(buffer + 12 + i*2,
- sizeof(buffer), "%02x",
+ sizeof(buffer) - 12 - i*2, "%02x",
fr_rand() & 0xff);
}
snprintf(buffer + 12 + 32, sizeof(buffer) - 45,