Commit Diff

Commit:
627b0b713c52406e50c84bb9459e7794262920a2
From:
Florian Westphal <fw@strlen.de>
Via:
Alexander Barton <alex@barton.de>
Date:
Message:
security: fix remotely triggerable crash in SSL/TLS code When a server is running with SSL/TLS support compiled in, it is trivial to crash the server by sending an MOTD request via another server in the network. - ONLY servers without ssl/tls support compiled in are not affected. Disabling SSL in the configuration (no ssl listening ports, etc) does NOT help. - servers that are running standalone (i.e., not connected to any other servers) are not affected, either. This affects all ngircd releases since ngircd 13 (earlier versions have no SSL/TLS support).
Actions:
Patch | Tree
commit - 95428a72ffb5214826b61d5e77f860e7ef6a6c9e
commit + 627b0b713c52406e50c84bb9459e7794262920a2
blob - 9752a6191c7e2da5b0df64779e9cc28ad1e6241c
blob + c6095a31c613bc5ca127d55b8723e15b836f1cca
--- src/ngircd/conn.c
+++ src/ngircd/conn.c
@@ -1951,6 +1951,9 @@ Conn_GetClient( CONN_ID Idx ) 
 GLOBAL bool
 Conn_GetCipherInfo(CONN_ID Idx, char *buf, size_t len)
 {
+	if (Idx < 0)
+		return false;
+	assert(Idx < (int) array_length(&My_ConnArray, sizeof(CONNECTION)));
 	return ConnSSL_GetCipherInfo(&My_Connections[Idx], buf, len);
 }
 
@@ -1958,6 +1961,9 @@ Conn_GetCipherInfo(CONN_ID Idx, char *buf, size_t len)
 GLOBAL bool
 Conn_UsesSSL(CONN_ID Idx)
 {
+	if (Idx < 0)
+		return false;
+	assert(Idx < (int) array_length(&My_ConnArray, sizeof(CONNECTION)));
 	return Conn_OPTION_ISSET(&My_Connections[Idx], CONN_SSL);
 }
 #endif