socks5_connect(): Don't try to send credentials when none are configured

Fixes a crash due to a NULL-pointer dereference when
the socks server misbehaves.

OVE-20210207-0001.

Reported by: Joshua Rogers (Opera)

diff --git a/gateway.c b/gateway.c
index 135b217..e28ebb3 100644 (file)
--- a/gateway.c
+++ b/gateway.c
@@ -1180,11 +1180,20 @@ static jb_socket socks5_connect(const struct forward_spec *fwd,
 
    if (!err && (sbuf[1] == '\x02'))
    {
 
    if (!err && (sbuf[1] == '\x02'))
    {

-      /* check cbuf overflow */
-      size_t auth_len = strlen(fwd->auth_username) + strlen(fwd->auth_password) + 3;
-      if (auth_len > sizeof(cbuf))
+      if (fwd->auth_username && fwd->auth_password)

       {
       {

-         errstr = "SOCKS5 username and/or password too long";
+         /* check cbuf overflow */
+         size_t auth_len = strlen(fwd->auth_username) + strlen(fwd->auth_password) + 3;
+         if (auth_len > sizeof(cbuf))
+         {
+            errstr = "SOCKS5 username and/or password too long";
+            err = 1;
+         }
+      }
+      else
+      {
+         errstr = "SOCKS5 server requested authentication while "
+            "no credentials are configured";

          err = 1;
       }
 
          err = 1;
       }