Changeset 087a3c9 in nscp

Timestamp:

02/19/08 19:10:56 (5 years ago)

Author:

Michael Medin <michael@…>

Children:

6922706

Parents:

34f5502

Message:

+ Fixed a buffer overflow in the NRPE socket handling.

Location:

trunk

Files:

• NSClient++.cpp (modified) (1 diff)
• changelog (modified) (1 diff)
• include/NSCHelper.cpp (modified) (3 diffs)
• modules/NRPEListener/NRPEListener.cpp (modified) (1 diff)

trunk/NSClient++.cpp

@@ -534 +534 @@
     } catch(const NSPluginException& e) {
       LOG_ERROR_STD(_T("Exception raised: ") + e.error_ + _T(" in module: ") + e.file_);
+      return NSCAPI::returnCRIT;
+    } catch(...) {
+      LOG_ERROR_STD(_T("Unknown exception raised in module"));
       return NSCAPI::returnCRIT;
     }

trunk/changelog

@@ -6 +6 @@
  * Add API for rehashing the daemon (or implement it the API is there but does nothing)
 
+2008-02-19 MickeM
+ + Fixed a buffer overflow in the NRPE socket handling.
+ 
 2008-02-18 MickeM
  + Added propper output handling to process subsystem (now you can execute programs tat return "much" data.

trunk/include/NSCHelper.cpp

@@ -24 +24 @@
 #include <msvc_wrappers.h>
 #include <config.h>
+#include <strEx.h>
 
 #ifdef DEBUG
@@ -69 +70 @@
 int NSCHelper::wrapReturnString(TCHAR *buffer, unsigned int bufLen, std::wstring str, int defaultReturnCode ) {
   // @todo deprecate this
-  if (str.length() >= bufLen)
+  if (str.length() >= bufLen) {
+    std::wstring sstr = str.substr(0, min(10, str.length()));
+    NSC_DEBUG_MSG_STD(_T("String (") + strEx::itos(str.length()) + _T(") to long to fit inside buffer(") + strEx::itos(bufLen) + _T(") : ") + sstr);
     return NSCAPI::isInvalidBufferLen;
+  }
   wcsncpy_s(buffer, bufLen, str.c_str(), bufLen);
   return defaultReturnCode;
@@ -110 +114 @@
   else if (returnCode == NSCAPI::returnWARN)
     return _T("WARNING");
+  else if (returnCode == NSCAPI::returnUNKNOWN)
+    return _T("WARNING");
   else
-    return _T("UNKNOWN");
+    return _T("BAD_CODE");
 }
 

trunk/modules/NRPEListener/NRPEListener.cpp

@@ -388 +388 @@
       ret = NSCAPI::returnUNKNOWN;
   }
-  if (msg.length() >= buffer_length_) {
+  if (msg.length() >= buffer_length_-1) {
     NSC_LOG_ERROR(_T("Truncating returndata as it is bigger then NRPE allowes :("));
-    msg = msg.substr(0,buffer_length_-1);
+    msg = msg.substr(0,buffer_length_-2);
   }
   if (perf.empty()||noPerfData_) {