From 85817cc55b9829e6c20db40d3a93b8380618463d Mon Sep 17 00:00:00 2001 From: Fabian Keil Date: Sun, 7 Feb 2021 13:24:15 +0100 Subject: [PATCH] socks5_connect(): Don't try to send credentials when none are configured Fixes a crash due to a NULL-pointer dereference when the socks server misbehaves. OVE-20210207-0001. Reported by: Joshua Rogers (Opera) --- gateway.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/gateway.c b/gateway.c index 135b2173..e28ebb33 100644 --- a/gateway.c +++ b/gateway.c @@ -1180,11 +1180,20 @@ static jb_socket socks5_connect(const struct forward_spec *fwd, if (!err && (sbuf[1] == '\x02')) { - /* check cbuf overflow */ - size_t auth_len = strlen(fwd->auth_username) + strlen(fwd->auth_password) + 3; - if (auth_len > sizeof(cbuf)) + if (fwd->auth_username && fwd->auth_password) { - errstr = "SOCKS5 username and/or password too long"; + /* check cbuf overflow */ + size_t auth_len = strlen(fwd->auth_username) + strlen(fwd->auth_password) + 3; + if (auth_len > sizeof(cbuf)) + { + errstr = "SOCKS5 username and/or password too long"; + err = 1; + } + } + else + { + errstr = "SOCKS5 server requested authentication while " + "no credentials are configured"; err = 1; } -- 2.39.2