mir/sudo
2
0
Fork 0
mirror of https://github.com/sudo-project/sudo.git synced 2025-09-03 07:45:47 +00:00
Code Issues Releases Wiki Activity

Strict tz offset parsing.

Browse Source 
Fixes an out of bounds read found locally using libfuzzer/oss-fuzz.
This commit is contained in:
Todd C. Miller
2021-01-30 09:29:31 -07:00
parent 9f81e8a109
commit 439660c7fb
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
plugins/sudoers/gentime.c
View File

@@ -104,6 +104,14 @@ parse_gentime(const char *timestr)
/* No DST */ /* No DST */
tm.tm_isdst = 0; tm.tm_isdst = 0;
/* time zone offset must be hh or hhmm */
len = strspn(cp + 1, "0123456789");
if (len != 2 && len != 4) {
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
"unable to parse time zone offset in %s, bad tz offset",
timestr);
debug_return_time_t(-1);
}
/* parse time zone offset */ /* parse time zone offset */
items = sscanf(cp + 1, "%2d%2d", &hour, &min); items = sscanf(cp + 1, "%2d%2d", &hour, &min);
if (items == EOF || items < 1) { if (items == EOF || items < 1) {