From 925c5ca83e5eb67604b837ce8d3e02fae2adb260 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Thu, 15 May 2014 01:54:18 +0100 Subject: [PATCH] site: SECURITY: Properly update full peer address array If we already have the maximum number of peer addresses, do not stuff the peer address into the wrong slot. If a site instance is configured with the maximum permissible limit on the number of mobile peer addresses (ie with mobile-peers-max set to 5), this overruns the transport peers array. In such a configuration this is a security problem. It looks like a denial of service and privilege escalation can't be ruled out. Configurations without mobile peers are not affected. Otherwise it simply means the address is ignored. Signed-off-by: Ian Jackson --- site.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site.c b/site.c index f87328f..f0a2922 100644 --- a/site.c +++ b/site.c @@ -1955,7 +1955,7 @@ static void transport_record_peer(struct site *st, transport_peers *peers, changed=1; if (peers->npeers==st->transport_peers_max) - slot=st->transport_peers_max; + slot=st->transport_peers_max-1; else slot=peers->npeers++; -- 2.11.0