[Privoxy-commits] [privoxy] 04/06: socks5_connect(): Don't try to send credentials when none are configured

[User Git]

This is an automated email from the git hooks/post-receive script.

git pushed a commit to branch master
in repository privoxy.

commit 85817cc55b9829e6c20db40d3a93b8380618463d
Author: Fabian Keil <fk at fabiankeil.de>
AuthorDate: Sun Feb 7 13:24:15 2021 +0100

    socks5_connect(): Don't try to send credentials when none are configured
    
    Fixes a crash due to a NULL-pointer dereference when
    the socks server misbehaves.
    
    OVE-20210207-0001.
    
    Reported by: Joshua Rogers (Opera)
---
 gateway.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/gateway.c b/gateway.c
index 135b2173..e28ebb33 100644
--- a/gateway.c
+++ b/gateway.c
@@ -1180,11 +1180,20 @@ static jb_socket socks5_connect(const struct forward_spec *fwd,
 
    if (!err && (sbuf[1] == '\x02'))
    {
-      /* check cbuf overflow */
-      size_t auth_len = strlen(fwd->auth_username) + strlen(fwd->auth_password) + 3;
-      if (auth_len > sizeof(cbuf))
+      if (fwd->auth_username && fwd->auth_password)
       {
-         errstr = "SOCKS5 username and/or password too long";
+         /* check cbuf overflow */
+         size_t auth_len = strlen(fwd->auth_username) + strlen(fwd->auth_password) + 3;
+         if (auth_len > sizeof(cbuf))
+         {
+            errstr = "SOCKS5 username and/or password too long";
+            err = 1;
+         }
+      }
+      else
+      {
+         errstr = "SOCKS5 server requested authentication while "
+            "no credentials are configured";
          err = 1;
       }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.