diff --git a/CASA/CASA.changes b/CASA/CASA.changes index f7cc8ba2..22f8eb87 100644 --- a/CASA/CASA.changes +++ b/CASA/CASA.changes @@ -1,3 +1,8 @@ +------------------------------------------------------------------- +Tue May 8 12:01:24 MDT 2007 - jnorman@novell.com + +- Bug 222012. Fix for security audit 5.1.2 + ------------------------------------------------------------------- Wed May 2 11:59:20 MDT 2007 - jnorman@novell.com diff --git a/CASA/micasad/lib/communication/UnixIPCClientChannel.cs b/CASA/micasad/lib/communication/UnixIPCClientChannel.cs index faac470f..b33a8e23 100644 --- a/CASA/micasad/lib/communication/UnixIPCClientChannel.cs +++ b/CASA/micasad/lib/communication/UnixIPCClientChannel.cs @@ -94,12 +94,6 @@ namespace Novell.CASA.MiCasa.Communication * allocate. */ - byte[] msgIdBytes = new byte[2]; - bytesRecvd = mSocket.Receive(msgIdBytes); - if (0 == bytesRecvd) - { - return null; - } byte[] msgLenBytes = new byte[4]; bytesRecvd = mSocket.Receive(msgLenBytes); if (0 == bytesRecvd) @@ -108,6 +102,14 @@ namespace Novell.CASA.MiCasa.Communication } uint msgLen = BitConverter.ToUInt32(msgLenBytes, 0); + + // micasad shouldn't return anything too large, however just in case + // don't loop forever + if (msgLen > int.MaxValue) + { + return null; + } + if (msgLen > 6) { byte[] buf = null; @@ -118,6 +120,7 @@ namespace Novell.CASA.MiCasa.Communication // buffer for data MemoryStream ms = new MemoryStream(); + ms.Write(msgLenBytes, 0, 4); while (totalBytes < (msgLen - 6)) { @@ -134,21 +137,24 @@ namespace Novell.CASA.MiCasa.Communication } if (totalBytes == 0) return null; - - byte[] finalbuf = ms.ToArray(); + + return ms.ToArray(); + /* + byte[] finalbuf = ms.ToArray(); int returnBufferLen = msgIdBytes.Length + msgLenBytes.Length + totalBytes; returnBuffer = new byte[returnBufferLen]; Array.Copy(msgIdBytes, returnBuffer, 2); Array.Copy(msgLenBytes, 0, returnBuffer, 2, 4); Array.Copy(finalbuf, 0, returnBuffer, 6, finalbuf.Length); return returnBuffer; + * + */ } else { - returnBuffer = new byte[6]; - Array.Copy(msgIdBytes, returnBuffer, 2); - Array.Copy(msgLenBytes, 0, returnBuffer, 2, 4); + returnBuffer = new byte[4]; + Array.Copy(msgLenBytes, 0, returnBuffer, 0, 4); return returnBuffer; } } @@ -164,7 +170,6 @@ namespace Novell.CASA.MiCasa.Communication try { mSocket.Send(buf); - //Console.WriteLine("Bytes written = " + buf.Length); return buf.Length; } catch (Exception e)