francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
53 lines
1.9 KiB
Diff
53 lines
1.9 KiB
Diff
From 0d89165ee6da10e6fa50c44998b3cd16d59400e9 Mon Sep 17 00:00:00 2001
|
|
From: Alex Rousskov <rousskov@measurement-factory.com>
|
|
Date: Sat, 30 Aug 2025 06:49:36 +0000
|
|
Subject: [PATCH] Fix ASN.1 encoding of long SNMP OIDs (#2149)
|
|
|
|
CVE: CVE-2025-59362
|
|
Upstream-Status: Backport [https://github.com/squid-cache/squid/commit/0d89165ee6da10e6fa50c44998b3cd16d59400e9]
|
|
Signed-off-by: Peter Marko <peter.marko@siemens.com>
|
|
---
|
|
lib/snmplib/asn1.c | 13 +++++++++++++
|
|
1 file changed, 13 insertions(+)
|
|
|
|
diff --git a/lib/snmplib/asn1.c b/lib/snmplib/asn1.c
|
|
index 81f2051fb..2852c26b2 100644
|
|
--- a/lib/snmplib/asn1.c
|
|
+++ b/lib/snmplib/asn1.c
|
|
@@ -735,6 +735,7 @@ asn_build_objid(u_char * data, int *datalength,
|
|
* lastbyte ::= 0 7bitvalue
|
|
*/
|
|
u_char buf[MAX_OID_LEN];
|
|
+ u_char *bufEnd = buf + sizeof(buf);
|
|
u_char *bp = buf;
|
|
oid *op = objid;
|
|
int asnlength;
|
|
@@ -753,6 +754,10 @@ asn_build_objid(u_char * data, int *datalength,
|
|
while (objidlength-- > 0) {
|
|
subid = *op++;
|
|
if (subid < 127) { /* off by one? */
|
|
+ if (bp >= bufEnd) {
|
|
+ snmp_set_api_error(SNMPERR_ASN_ENCODE);
|
|
+ return (NULL);
|
|
+ }
|
|
*bp++ = subid;
|
|
} else {
|
|
mask = 0x7F; /* handle subid == 0 case */
|
|
@@ -770,8 +775,16 @@ asn_build_objid(u_char * data, int *datalength,
|
|
/* fix a mask that got truncated above */
|
|
if (mask == 0x1E00000)
|
|
mask = 0xFE00000;
|
|
+ if (bp >= bufEnd) {
|
|
+ snmp_set_api_error(SNMPERR_ASN_ENCODE);
|
|
+ return (NULL);
|
|
+ }
|
|
*bp++ = (u_char) (((subid & mask) >> bits) | ASN_BIT8);
|
|
}
|
|
+ if (bp >= bufEnd) {
|
|
+ snmp_set_api_error(SNMPERR_ASN_ENCODE);
|
|
+ return (NULL);
|
|
+ }
|
|
*bp++ = (u_char) (subid & mask);
|
|
}
|
|
}
|