pkgsrc/chat/licq-core/patches/patch-ag
tonnerre 2b32a72a59 Fix multiple connection handling Denial of Service vulnerability in licq
(CVE-2008-1996). Before this, the application would crash if too many TCP
connections are opened.
2008-05-11 04:12:34 +00:00

26 lines
883 B
Text

$NetBSD: patch-ag,v 1.3 2008/05/11 04:12:34 tonnerre Exp $
--- src/socket.cpp.orig 2007-10-15 20:11:50.000000000 +0200
+++ src/socket.cpp
@@ -817,8 +817,19 @@ void TCPSocket::RecvConnection(TCPSocket
{
socklen_t sizeofSockaddr = sizeof(struct sockaddr_in);
- newSocket.m_nDescriptor = accept(m_nDescriptor, (struct sockaddr *)&newSocket.m_sRemoteAddr, &sizeofSockaddr);
- newSocket.SetLocalAddress();
+ int newDesc = accept(m_nDescriptor, (struct sockaddr *)&newSocket.m_sRemoteAddr, &sizeofSockaddr);
+ if (newDesc < FD_SETSIZE)
+ {
+ newSocket.m_nDescriptor = newDesc;
+ newSocket.SetLocalAddress();
+ }
+ else
+ {
+ gLog.Error(tr("%sCannot accept new connection, too many descriptors in use.\n"), L_ERRORxSTR);
+ close(newDesc);
+
+ // TODO throw an exception, or do something to tell the caller it failed
+ }
}
#define m_pSSL ((SSL *) m_p_SSL)