From ed31fe2cbd5b8b1148b467f84f7acea66fa43bb8 Mon Sep 17 00:00:00 2001 From: Chris Hofstaedtler Date: Tue, 3 Aug 2021 21:53:28 +0200 Subject: [PATCH] CVE-2021-46854 mod_radius: copy _only_ the password Upstream-Status: Backport [https://github.com/proftpd/proftpd/commit/10a227b4d50e0a2cd2faf87926f58d865da44e43] CVE: CVE-2021-46854 Signed-off-by: Hitendra Prajapati --- contrib/mod_radius.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/contrib/mod_radius.c b/contrib/mod_radius.c index b56cdfe..f234dd5 100644 --- a/contrib/mod_radius.c +++ b/contrib/mod_radius.c @@ -2319,21 +2319,26 @@ static void radius_add_passwd(radius_packet_t *packet, unsigned char type, pwlen = strlen((const char *) passwd); + /* Clear the buffers. */ + memset(pwhash, '\0', sizeof(pwhash)); + if (pwlen == 0) { pwlen = RADIUS_PASSWD_LEN; } if ((pwlen & (RADIUS_PASSWD_LEN - 1)) != 0) { + /* pwlen is not a multiple of RADIUS_PASSWD_LEN, need to prepare a proper buffer */ + memcpy(pwhash, passwd, pwlen); /* Round up the length. */ pwlen += (RADIUS_PASSWD_LEN - 1); /* Truncate the length, as necessary. */ pwlen &= ~(RADIUS_PASSWD_LEN - 1); + } else { + /* pwlen is a multiple of RADIUS_PASSWD_LEN, we can just use it. */ + memcpy(pwhash, passwd, pwlen); } - /* Clear the buffers. */ - memset(pwhash, '\0', sizeof(pwhash)); - memcpy(pwhash, passwd, pwlen); /* Find the password attribute. */ attrib = radius_get_attrib(packet, RADIUS_PASSWORD); -- 2.25.1