From b52e8e2538b2b48ef6b63bff12b5cc9e2d52eff1 Mon Sep 17 00:00:00 2001 From: Corey Minyard Date: Mon, 29 Apr 2024 12:46:23 -0500 Subject: [PATCH] lanserv: Check some bounds on incoming messages Signed-off-by: Corey Minyard Reference:https://sourceforge.net/p/openipmi/code/ci/b52e8e2538b2b48ef6b63bff12b5cc9e2d52eff1/ Conflict:NA --- lanserv/lanserv_ipmi.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/lanserv/lanserv_ipmi.c b/lanserv/lanserv_ipmi.c index ccd6001..0ee6451 100644 --- a/lanserv/lanserv_ipmi.c +++ b/lanserv/lanserv_ipmi.c @@ -882,6 +882,12 @@ handle_temp_session(lanserv_data_t *lan, msg_t *msg) } auth = msg->data[0] & 0xf; + if (auth >= MAX_IPMI_AUTHS) { + lan->sysinfo->log(lan->sysinfo, NEW_SESSION_FAILED, msg, + "Activate session failed: Invalid auth: 0x%x", auth); + return; + } + user = &(lan->users[user_idx]); if (! (user->valid)) { lan->sysinfo->log(lan->sysinfo, NEW_SESSION_FAILED, msg, @@ -3034,6 +3040,11 @@ ipmi_handle_lan_msg(lanserv_data_t *lan, } msg.authtype = data[4]; + if (msg.authtype >= MAX_IPMI_AUTHS) { + lan->sysinfo->log(lan->sysinfo, LAN_ERR, &msg, + "LAN msg failure: Invalid authtype"); + return; + } msg.data = data+5; msg.len = len - 5; msg.channel = lan->channel.channel_num; -- 2.43.0