1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
|
From 87a0d27102ceffb92e5c1d6fbbd24972a9dd33ac Mon Sep 17 00:00:00 2001
From: Junling Zheng <zhengjunling@huawei.com>
Date: Mon, 20 Apr 2015 10:23:08 +0000
Subject: [PATCH] Fix CVE-2014-2285
Sending SNMP trap with empty community string crashes snmptrapd if Perl
handler is enabled.
Refer to:
https://bugzilla.redhat.com/show_bug.cgi?id=1072044
Upstream Status: Backported
Signed-off-by: Junling Zheng <zhengjunling@huawei.com>
---
perl/TrapReceiver/TrapReceiver.xs | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/perl/TrapReceiver/TrapReceiver.xs b/perl/TrapReceiver/TrapReceiver.xs
index 531bfa4..ac94370 100644
--- a/perl/TrapReceiver/TrapReceiver.xs
+++ b/perl/TrapReceiver/TrapReceiver.xs
@@ -81,18 +81,18 @@ int perl_trapd_handler( netsnmp_pdu *pdu,
STOREPDUi("securitymodel", pdu->securityModel);
STOREPDUi("securitylevel", pdu->securityLevel);
STOREPDU("contextName",
- newSVpv(pdu->contextName, pdu->contextNameLen));
+ newSVpv(pdu->contextName ? pdu->contextName : "", pdu->contextNameLen));
STOREPDU("contextEngineID",
- newSVpv((char *) pdu->contextEngineID,
+ newSVpv((char *)(pdu->contextEngineID ? pdu->contextEngineID : ""),
pdu->contextEngineIDLen));
STOREPDU("securityEngineID",
- newSVpv((char *) pdu->securityEngineID,
+ newSVpv((char *)(pdu->securityEngineID ? pdu->securityEngineID : ""),
pdu->securityEngineIDLen));
STOREPDU("securityName",
- newSVpv((char *) pdu->securityName, pdu->securityNameLen));
+ newSVpv((char *)(pdu->securityName ? pdu->securityName : ""), pdu->securityNameLen));
} else {
STOREPDU("community",
- newSVpv((char *) pdu->community, pdu->community_len));
+ newSVpv((char *)(pdu->community ? pdu->community : ""), pdu->community_len));
}
if (transport && transport->f_fmtaddr) {
--
1.8.3.4
|
