Security #5027: smtp: GetLine function buffers data indefinitely if 0x0a was not found int the frag'd input - Suricata - Open Information Security Foundation

Actions

Copy link

Security #5027

closed

smtp: GetLine function buffers data indefinitely if 0x0a was not found int the frag'd input

Added by Shivani Bhardwaj almost 3 years ago. Updated about 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Shivani Bhardwaj

Target version:

6.0.5

Affected Versions:

Label:

CVE:

Git IDs:

7d30fb152afdbbea81dfa601f239254da2b786e9
7f5115395fd918417e4914ab42143f2ee91e6e28
a63133a4b6ebe4dc83298f38de50e5c73efe82f0
17ed7836a3df38c343956d8ceefd0ac3f442a243
cb3e66d6e9dabd1178693088180427cddf28b3f2

Severity:

MODERATE

Disclosure Date:

Description

The code we tend to execute is

                ptmp = SCRealloc(state->ts_db,
                                 (state->ts_db_len + state->input_len));
                if (ptmp == NULL) {
                    SCFree(state->ts_db);
                    state->ts_db = NULL;
                    state->ts_db_len = 0;
                    return -1;
                }
                state->ts_db = ptmp;

                memcpy(state->ts_db + state->ts_db_len,
                       state->input, state->input_len);
                state->ts_db_len += state->input_len;
            } /* else */
            state->input += state->input_len;
            state->input_len = 0;

indefinitely.

Related issues 1 (0 open — 1 closed)