denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

traffic-selector: Avoid out-of-bound array access when calculating range

Browse Source 
This happens for `/0` subnet masks.  In practice, it's not an issue because
if `bytes` is 0, then so are `netbits`, `bits` and `mask`.  So the two
incorrectly addressed array elements are not actually modified.  The first
operation is a `&= 0xff` and the second a `|= 0`, so nothing changes.
But some tools might not consider the values and report this as undefined
behavior, which it technically is.
This commit is contained in:
Tobias Brunner
2022-03-16 11:54:34 +01:00
parent 8100f2f255
commit 3c028686de
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/selectors/traffic_selector.c
+6 -2
View File
@@ -109,8 +109,12 @@ static void calc_range(private_traffic_selector_t *this, uint8_t netbits)
memcpy(this->to, this->from, bytes); memcpy(this->to, this->from, bytes);
memset(this->from + bytes, 0x00, len - bytes); memset(this->from + bytes, 0x00, len - bytes);
memset(this->to + bytes, 0xff, len - bytes); memset(this->to + bytes, 0xff, len - bytes);
this->from[bytes-1] &= ~mask;
this->to[bytes-1] |= mask; if (bytes)
{
this->from[bytes-1] &= ~mask;
this->to[bytes-1] |= mask;
}
} }
/** /**