From 732ac9a587f16dd7fcfc647e7428bcb8b8de3eae Mon Sep 17 00:00:00 2001 From: Gordon Tetlow Date: Tue, 28 Jan 2020 18:55:25 +0000 Subject: [PATCH] Fix libfetch buffer overflow Reported by: Duncan Overbruck Approved by: so Security: FreeBSD-SA-20:01.libfetch Security: CVE-2020-7450 --- lib/libfetch/fetch.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/libfetch/fetch.c b/lib/libfetch/fetch.c index ea8c3386470..a6866bc5958 100644 --- a/lib/libfetch/fetch.c +++ b/lib/libfetch/fetch.c @@ -330,6 +330,8 @@ fetch_pctdecode(char *dst, const char *src, size_t dlen) } if (dlen-- > 0) *dst++ = c; + else + return (NULL); } return (s); } @@ -377,11 +379,15 @@ fetchParseURL(const char *URL) if (p && *p == '@') { /* username */ q = fetch_pctdecode(u->user, URL, URL_USERLEN); + if (q == NULL) + goto ouch; /* password */ - if (*q == ':') + if (*q == ':') { q = fetch_pctdecode(u->pwd, q + 1, URL_PWDLEN); - + if (q == NULL) + goto ouch; + } p++; } else { p = URL; -- 2.45.0