1 CVE-2012-0804 - Fix proxy response parser

     2 

     3 If proxy sends overlong HTTP vesion string, the string will be copied

     4 to unallocatd space (write_buf) causing heap overflow.

     5 

     6 This patch fixes it by ignoring the HTTP version string and checking

     7 the response line has been parsed correctly.

     8 

     9 See <https://bugzilla.redhat.com/show_bug.cgi?id=773699> for more

    10 details.

    11 

    12 --- cvs-1.12.13/src/client.c.orig	2013-12-09 13:26:55.209065160 -0800

    13 +++ cvs-1.12.13/src/client.c	2013-12-09 13:32:25.632884394 -0800

    14 @@ -3558,9 +3558,9 @@

    15           * code.

    16           */

    17  	read_line_via (from_server, to_server, &read_buf);

    18 -	sscanf (read_buf, "%s %d", write_buf, &codenum);

    19 +	count = sscanf (read_buf, "%*s %d", &codenum);

    20  

    21 -	if ((codenum / 100) != 2)

    22 +	if (count != 1 || (codenum / 100) != 2)

    23  	    error (1, 0, "proxy server %s:%d does not support http tunnelling",

    24  		   root->proxy_hostname, proxy_port_number);

    25  	free (read_buf);