bughz/3proxy
1
0
Fork 0
mirror of https://github.com/3proxy/3proxy.git synced 2026-08-05 17:20:11 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix: buffer overflow in radsend (log radius or combination of auth radius with fakeresolve must be enabled, RADIUS feature is experimental)
Some checks failed
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Has been cancelled
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Vladimir Dubrovin 2026-07-28 11:31:06 +03:00
parent 5f542a505a
commit e4a5a7252c
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/authradius.c
View File

@ -391,6 +391,7 @@ int radsend(struct clientparam * param, int auth, int stop){
if(conf.stringtable){ if(conf.stringtable){
*ptr++ = PW_NAS_IDENTIFIER; *ptr++ = PW_NAS_IDENTIFIER;
len = strlen((char *)conf.stringtable[SERVICES+param->service]); len = strlen((char *)conf.stringtable[SERVICES+param->service]);
if(len > 253) len = 253;
*ptr++ = (2 + len); *ptr++ = (2 + len);
memcpy(ptr, conf.stringtable[SERVICES+param->service], len); memcpy(ptr, conf.stringtable[SERVICES+param->service], len);
ptr += len; ptr += len;
@ -416,6 +417,7 @@ int radsend(struct clientparam * param, int auth, int stop){
if(param->hostname){ if(param->hostname){
*ptr++ = PW_CALLED_STATION_ID; *ptr++ = PW_CALLED_STATION_ID;
len = strlen((char *)param->hostname); len = strlen((char *)param->hostname);
if(len > 253) len = 253;
*ptr++ = (2 + len); *ptr++ = (2 + len);
memcpy(ptr, param->hostname, len); memcpy(ptr, param->hostname, len);
ptr += len; ptr += len;

5
src/common.c
View File

@ -507,6 +507,11 @@ int parsehostname(char *hostname, struct clientparam *param, uint16_t port){
*SAPORT(&param->req) = htons(port); *SAPORT(&param->req) = htons(port);
return 0; return 0;
} }
if(strlen(hostname + (se!=0)) > 253){
if(se) *se = ']';
if(sp) *sp = ':';
return 1;
}
if(hostname != (char *)param->hostname){ if(hostname != (char *)param->hostname){
if(param->hostname) free(param->hostname); if(param->hostname) free(param->hostname);
param->hostname = (unsigned char *)strdup(hostname + (se!=0)); param->hostname = (unsigned char *)strdup(hostname + (se!=0));