diff --git a/CASA.changes b/CASA.changes index da69f5b0..3440fddb 100644 --- a/CASA.changes +++ b/CASA.changes @@ -1,3 +1,13 @@ +------------------------------------------------------------------- +Wed Mar 29 19:40:35 IST 2006 - lsreevatsa@novell.com + +- Security Audit Report : Patch for Bug No. 5.12.1. + File : c_micasacache/sscs_unx_ipc_client.c. +- Added a check to verify whether size of the token is + less than NSSCS_MAX_SECRET_ID_LEN(512) assuring that + sscs_Utf8Strcpy() will not copy more bytes than memory + availble. + ------------------------------------------------------------------- Wed Mar 29 19:20:12 IST 2006 - lsreevatsa@novell.com diff --git a/c_micasacache/sscs_unx_ipc_client.c b/c_micasacache/sscs_unx_ipc_client.c index b71155a1..5d280369 100644 --- a/c_micasacache/sscs_unx_ipc_client.c +++ b/c_micasacache/sscs_unx_ipc_client.c @@ -128,11 +128,23 @@ int Tokenize( int tokenType, char* buffer, void *idList ) { if( 0 == tokenType ) { + if(sscs_Utf8Strlen(tok) >= NSSCS_MAX_SECRET_ID_LEN) + { + //We are skipping this token. + //TBD:We need to find a wayto inform this to the clients. + continue; + } sscs_Utf8Strcpy(((SSCS_KEYCHAIN_ID_T*)idList)[i].keychainID,tok); ((SSCS_KEYCHAIN_ID_T*)idList)[i].len = sscs_Utf8StrSize(tok); } else { + if(sscs_Utf8Strlen(tok) >= NSSCS_MAX_SECRET_ID_LEN) + { + //We are skipping this token. + //TBD:We need to find a wayto inform this to the clients. + continue; + } sscs_Utf8Strcpy(((SSCS_SECRET_ID_T*)idList)[i].id,tok); ((SSCS_SECRET_ID_T*)idList)[i].len = sscs_Utf8StrSize(tok); } @@ -150,11 +162,23 @@ int Tokenize( int tokenType, char* buffer, void *idList ) /* While there are tokens in "string" */ if( 0 == tokenType ) { + if(sscs_Utf8Strlen(tok) >= NSSCS_MAX_SECRET_ID_LEN) + { + //We are skipping this token. + //TBD:We need to find a wayto inform this to the clients. + continue; + } sscs_Utf8Strcpy(((SSCS_KEYCHAIN_ID_T*)idList)[i].keychainID,tok); ((SSCS_KEYCHAIN_ID_T*)idList)[i].len = sscs_Utf8StrSize(tok); } else { + if(sscs_Utf8Strlen(tok) >= NSSCS_MAX_SECRET_ID_LEN) + { + //We are skipping this token. + //TBD:We need to find a wayto inform this to the clients. + continue; + } sscs_Utf8Strcpy(((SSCS_SECRET_ID_T*)idList)[i].id,tok); ((SSCS_SECRET_ID_T*)idList)[i].len = sscs_Utf8StrSize(tok); }