Added AMT MPS input checks.
Ylian Saint-Hilaire committed
Mar 25, 2022 at 11:02 UTC
1bb1dd0f59ba920f7f4e9db37a838e16ee15e178
1 file changed
+11
mpsserver.js
+11
@@ -584,14 +584,18 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
584
if (len < 13) return 0;
585
userAuthRequestCount++;
586
var usernameLen = common.ReadInt(data, 1);
587
+ if ((usernameLen > 2048) || (len < (5 + usernameLen))) return -1;
588
var username = data.substring(5, 5 + usernameLen);
589
var serviceNameLen = common.ReadInt(data, 5 + usernameLen);
590
+ if ((serviceNameLen > 2048) || (len < (9 + usernameLen + serviceNameLen))) return -1;
591
var serviceName = data.substring(9 + usernameLen, 9 + usernameLen + serviceNameLen);
592
var methodNameLen = common.ReadInt(data, 9 + usernameLen + serviceNameLen);
593
+ if ((methodNameLen > 2048) || (len < (13 + usernameLen + serviceNameLen + methodNameLen))) return -1;
594
var methodName = data.substring(13 + usernameLen + serviceNameLen, 13 + usernameLen + serviceNameLen + methodNameLen);
595
var passwordLen = 0, password = null;
596
if (methodName == 'password') {
597
passwordLen = common.ReadInt(data, 14 + usernameLen + serviceNameLen + methodNameLen);
598
+ if ((passwordLen > 2048) || (len < (18 + usernameLen + serviceNameLen + methodNameLen + passwordLen))) return -1;
599
password = data.substring(18 + usernameLen + serviceNameLen + methodNameLen, 18 + usernameLen + serviceNameLen + methodNameLen + passwordLen);
600
}
601
//console.log('MPS:USERAUTH_REQUEST user=' + username + ', service=' + serviceName + ', method=' + methodName + ', password=' + password);
@@ -874,6 +878,7 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
878
case APFProtocol.SERVICE_REQUEST: {
879
if (len < 5) return 0;
880
var xserviceNameLen = common.ReadInt(data, 1);
881
+ if (xserviceNameLen > 2048) return -1;
882
if (len < 5 + xserviceNameLen) return 0;
883
var xserviceName = data.substring(5, 5 + xserviceNameLen);
884
parent.debug('mpscmd', '--> SERVICE_REQUEST', xserviceName);
@@ -884,6 +889,7 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
889
case APFProtocol.GLOBAL_REQUEST: {
890
if (len < 14) return 0;
891
var requestLen = common.ReadInt(data, 1);
892
+ if (requestLen > 2048) return -1;
893
if (len < 14 + requestLen) return 0;
894
var request = data.substring(5, 5 + requestLen);
895
//var wantResponse = data.charCodeAt(5 + requestLen);
@@ -935,6 +941,7 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
941
case APFProtocol.CHANNEL_OPEN: {
942
if (len < 33) return 0;
943
var ChannelTypeLength = common.ReadInt(data, 1);
944
+ if (ChannelTypeLength > 2048) return -1;
945
if (len < (33 + ChannelTypeLength)) return 0;
946
947
// Decode channel identifiers and window size
@@ -944,12 +951,14 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
951
952
// Decode the target
953
var TargetLen = common.ReadInt(data, 17 + ChannelTypeLength);
954
+ if (TargetLen > 2048) return -1;
955
if (len < (33 + ChannelTypeLength + TargetLen)) return 0;
956
var Target = data.substring(21 + ChannelTypeLength, 21 + ChannelTypeLength + TargetLen);
957
var TargetPort = common.ReadInt(data, 21 + ChannelTypeLength + TargetLen);
958
959
// Decode the source
960
var SourceLen = common.ReadInt(data, 25 + ChannelTypeLength + TargetLen);
961
+ if (SourceLen > 2048) return -1;
962
if (len < (33 + ChannelTypeLength + TargetLen + SourceLen)) return 0;
963
var Source = data.substring(29 + ChannelTypeLength + TargetLen, 29 + ChannelTypeLength + TargetLen + SourceLen);
964
var SourcePort = common.ReadInt(data, 29 + ChannelTypeLength + TargetLen + SourceLen);
@@ -1076,6 +1085,7 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
1085
if (len < 9) return 0;
1086
var RecipientChannel = common.ReadInt(data, 1);
1087
var LengthOfData = common.ReadInt(data, 5);
1088
+ if (SourceLen > 1048576) return -1;
1089
if (len < (9 + LengthOfData)) return 0;
1090
parent.debug('mpscmddata', '--> CHANNEL_DATA', RecipientChannel, LengthOfData);
1091
var cirachannel = socket.tag.channels[RecipientChannel];
@@ -1103,6 +1113,7 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
1113
{
1114
if (len < 5) return 0;
1115
var jsondatalen = common.ReadInt(data, 1);
1116
+ if (jsondatalen > 1048576) return -1;
1117
if (len < (5 + jsondatalen)) return 0;
1118
var jsondata = null, jsondatastr = data.substring(5, 5 + jsondatalen);
1119
try { jsondata = JSON.parse(jsondatastr); } catch (ex) { }