1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137
|
From: Idan Freiberg
Subject: sesman: scpv0, accept variable length data fields
Origin: https://github.com/neutrinolabs/xrdp/commit/ebd0510a7d4dab906b6e01570205dfa530d1f7bf.diff
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882463
--- a/sesman/libscp/libscp_v0.c
+++ b/sesman/libscp/libscp_v0.c
@@ -157,7 +157,7 @@ scp_v0s_accept(struct SCP_CONNECTION *c,
struct SCP_SESSION *session = 0;
tui16 sz;
tui32 code = 0;
- char buf[257];
+ char *buf = 0;
if (!skipVchk)
{
@@ -222,27 +222,31 @@ scp_v0s_accept(struct SCP_CONNECTION *c,
/* reading username */
in_uint16_be(c->in_s, sz);
- buf[sz] = '\0';
+ buf = g_new0(char, sz + 1);
in_uint8a(c->in_s, buf, sz);
-
+ buf[sz] = '\0';
if (0 != scp_session_set_username(session, buf))
{
scp_session_destroy(session);
log_message(LOG_LEVEL_WARNING, "[v0:%d] connection aborted: error setting username", __LINE__);
+ g_free(buf);
return SCP_SERVER_STATE_INTERNAL_ERR;
}
+ g_free(buf);
/* reading password */
in_uint16_be(c->in_s, sz);
- buf[sz] = '\0';
+ buf = g_new0(char, sz + 1);
in_uint8a(c->in_s, buf, sz);
-
+ buf[sz] = '\0';
if (0 != scp_session_set_password(session, buf))
{
scp_session_destroy(session);
log_message(LOG_LEVEL_WARNING, "[v0:%d] connection aborted: error setting password", __LINE__);
+ g_free(buf);
return SCP_SERVER_STATE_INTERNAL_ERR;
}
+ g_free(buf);
/* width */
in_uint16_be(c->in_s, sz);
@@ -268,9 +272,11 @@ scp_v0s_accept(struct SCP_CONNECTION *c,
if (sz > 0)
{
+ buf = g_new0(char, sz + 1);
in_uint8a(c->in_s, buf, sz);
buf[sz] = '\0';
scp_session_set_domain(session, buf);
+ g_free(buf);
}
}
@@ -281,9 +287,11 @@ scp_v0s_accept(struct SCP_CONNECTION *c,
if (sz > 0)
{
+ buf = g_new0(char, sz + 1);
in_uint8a(c->in_s, buf, sz);
buf[sz] = '\0';
scp_session_set_program(session, buf);
+ g_free(buf);
}
}
@@ -294,9 +302,11 @@ scp_v0s_accept(struct SCP_CONNECTION *c,
if (sz > 0)
{
+ buf = g_new0(char, sz + 1);
in_uint8a(c->in_s, buf, sz);
buf[sz] = '\0';
scp_session_set_directory(session, buf);
+ g_free(buf);
}
}
@@ -307,9 +317,11 @@ scp_v0s_accept(struct SCP_CONNECTION *c,
if (sz > 0)
{
+ buf = g_new0(char, sz + 1);
in_uint8a(c->in_s, buf, sz);
buf[sz] = '\0';
scp_session_set_client_ip(session, buf);
+ g_free(buf);
}
}
}
@@ -328,29 +340,35 @@ scp_v0s_accept(struct SCP_CONNECTION *c,
scp_session_set_type(session, SCP_GW_AUTHENTICATION);
/* reading username */
in_uint16_be(c->in_s, sz);
- buf[sz] = '\0';
+ buf = g_new0(char, sz + 1);
in_uint8a(c->in_s, buf, sz);
+ buf[sz] = '\0';
/* g_writeln("Received user name: %s",buf); */
if (0 != scp_session_set_username(session, buf))
{
scp_session_destroy(session);
/* until syslog merge log_message(s_log, LOG_LEVEL_WARNING, "[v0:%d] connection aborted: error setting username", __LINE__);*/
+ g_free(buf);
return SCP_SERVER_STATE_INTERNAL_ERR;
}
+ g_free(buf);
/* reading password */
in_uint16_be(c->in_s, sz);
- buf[sz] = '\0';
+ buf = g_new0(char, sz + 1);
in_uint8a(c->in_s, buf, sz);
+ buf[sz] = '\0';
/* g_writeln("Received password: %s",buf); */
if (0 != scp_session_set_password(session, buf))
{
scp_session_destroy(session);
/* until syslog merge log_message(s_log, LOG_LEVEL_WARNING, "[v0:%d] connection aborted: error setting password", __LINE__); */
+ g_free(buf);
return SCP_SERVER_STATE_INTERNAL_ERR;
}
+ g_free(buf);
}
else
{
|