| CC: | allan-cpan [...] oepping.com |
| MIME-Version: | 1.0 |
| X-Google-Original-From: | Allan Oepping <allan-cpan [...] oepping.com> |
| X-Spam-Status: | No, score=-2.7 tagged_above=-99.9 required=10 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham |
| X-Spam-Flag: | NO |
| Content-Type: | multipart/mixed; boundary="------------D14E4066414EC82E0F861F66" |
| Message-ID: | <051ad417-ac22-cafc-8009-fb31d7097c78 [...] oepping.com> |
| X-Received: | by 10.107.18.27 with SMTP id a27mr247824ioj.126.1476223402946; Tue, 11 Oct 2016 15:03:22 -0700 (PDT) |
| X-Virus-Scanned: | Debian amavisd-new at bestpractical.com |
| X-Spam-Score: | -2.7 |
| Received: | from localhost (localhost [127.0.0.1]) by hipster.bestpractical.com (Postfix) with ESMTP id 549A32403C2 for <cpan-bug+Net-SSH-Perl [...] hipster.bestpractical.com>; Tue, 11 Oct 2016 18:03:33 -0400 (EDT) |
| Received: | from hipster.bestpractical.com ([127.0.0.1]) by localhost (hipster.bestpractical.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fygbEbY+qxev for <cpan-bug+Net-SSH-Perl [...] hipster.bestpractical.com>; Tue, 11 Oct 2016 18:03:32 -0400 (EDT) |
| Received: | from la.mx.develooper.com (x1.develooper.com [207.171.7.70]) by hipster.bestpractical.com (Postfix) with SMTP id A64872403A7 for <bug-Net-SSH-Perl [...] rt.cpan.org>; Tue, 11 Oct 2016 18:03:31 -0400 (EDT) |
| Received: | (qmail 23611 invoked by alias); 11 Oct 2016 22:03:30 -0000 |
| Received: | from mail-it0-f53.google.com (HELO mail-it0-f53.google.com) (209.85.214.53) by la.mx.develooper.com (qpsmtpd/0.28) with ESMTP; Tue, 11 Oct 2016 15:03:26 -0700 |
| Received: | by mail-it0-f53.google.com with SMTP id l13so121737979itl.1 for <bug-Net-SSH-Perl [...] rt.cpan.org>; Tue, 11 Oct 2016 15:03:26 -0700 (PDT) |
| Received: | from [10.1.10.210] ([63.226.98.35]) by smtp.gmail.com with ESMTPSA id c36sm2364559itd.2.2016.10.11.15.03.22 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 11 Oct 2016 15:03:22 -0700 (PDT) |
| Authentication-Results: | hipster.bestpractical.com (amavisd-new); dkim=pass header.i= [...] oepping.com |
| Delivered-To: | cpan-bug+Net-SSH-Perl [...] hipster.bestpractical.com |
| User-Agent: | Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 |
| Subject: | Net::SSH::Perl 2.01 - available length miscalculation in Packet.pm - patch included |
| Return-Path: | <allan [...] oepping.com> |
| X-RT-Mail-Extension: | net-ssh-perl |
| X-Original-To: | cpan-bug+Net-SSH-Perl [...] hipster.bestpractical.com |
| X-Spam-Check-BY: | la.mx.develooper.com |
| Dkim-Signature: | v=1; a=rsa-sha256; c=relaxed/relaxed; d=oepping.com; s=google; h=from:to:subject:cc:message-id:date:user-agent:mime-version; bh=lYh7ra3XCMpM/iEMKEkmPzw153kSMVEKRIjgMKAwdcQ=; b=fWNCYJuzX3wLRCS+HHGV2L7Da+haPFnvhlPbld1cqY+7/jOyOMS07hzbAEjIIco9p6 wZb076E+Vucr7/72U+nVmGv42XdFeGIu8cQtxK5LkkHw1nllPZjiUU+sCC5n/w69qLut /2WAMsJdGLX+5VdM5+SVF1K0XNqyDPMpN3meI= |
| X-Google-Dkim-Signature: | v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:cc:message-id:date:user-agent :mime-version; bh=lYh7ra3XCMpM/iEMKEkmPzw153kSMVEKRIjgMKAwdcQ=; b=O2gydq0oe22RC4seGu1ImrFa/yI3nS4paN81iv2I/RRPSPV/nD6j5TOl38kB4rEScQ ooNtPGVHviOQBRmzpwFtUXOAqH8aDYdb4fOfJ+HS+7ECsoxI4hjORO6cNM5jqHcbDDNU hqgm+kFWBcgxlsvPQLkM0RPJlioLhHgzjjeCGYM7H/krbS1O9q56Ft1rJFIBNpz+E1Te OR5k7k4RBiZTG0xEMfT7tMqZT5usT82QP0maoqAYXO6LNLilUqK/XdE+Eqo5oB0x0k3v JwWtpUQgvaZcknTyl5HXXcA+PLaNlZgqn2RaofkaKbRzyJKX5+PEHEybakrEwigOqlTv EyWg== |
| Date: | Tue, 11 Oct 2016 16:03:21 -0600 |
| X-Spam-Level: | |
| To: | bug-Net-SSH-Perl [...] rt.cpan.org |
| From: | Allan Oepping <allan [...] oepping.com> |
| X-GM-Message-State: | AA6/9Rk/YpbGFD9Sz6YfX0tUFEH86wxr2kTa6gGlIHNePWDeecEA5yLgVOhDzPAgeN1bvH9L |
| X-RT-Interface: | |
| Content-Length: | 0 |
| content-type: | text/plain; charset="utf-8" |
| Content-Transfer-Encoding: | 8bit |
| X-RT-Original-Encoding: | utf-8 |
| Content-Length: | 1155 |
Version string in Packet.pm: Packet.pm,v 1.25 2008/09/24 19:21:20
turnstep Exp
In Packet.pm in fuction read_poll_ssh2 if $mac && $mac->enabled but not
$mac->etm then $block_size bytes are also read from the $incoming buffer
but the $incoming->length may not be large enough to include a full read
of $stored_mac later in the code.
I added the a return if the length including block_size is not available
(Line after the comment "RETURN IF INSUFFICIENT BUF") and that seems to
fix the issue.
if ($mac && $mac->enabled) {
if ($mac->etm) {
$p_str = $incoming->bytes(0, $aadlen + $need, '');
$macbuf = $mac->hmac(pack("N", $seqnr) . $p_str);
# remove packet length bytes
substr($p_str,0,$aadlen,'');
} else {
#RETURN IF INSUFFICIENT BUF
return if $incoming->length < $aadlen + $need + $authlen
+ $maclen + $block_size;
# not etm mac, append bytes already decrypted above
$buffer->append( $incoming->bytes(0, $block_size, '') );
$p_str = $incoming->bytes(0, $need, '');
}
Unified diff/patch attached.
Thanks,
Allan Oepping
| Content-Type: | text/x-patch; name="packet-pm.patch" |
| Content-Disposition: | attachment; filename="packet-pm.patch" |
| Content-Transfer-Encoding: | quoted-printable |
| Content-Length: | 606 |
Message body is not shown because sender requested not to inline it.