Tue 25 Jul 2017 09:21:45 PM UTC, original submission:
Throughout the code, wget uses strncmp(), strncasecmp(), and similar incorrectly. For example, in http-ntlm.c (abbreviated):
/* return true on success, false otherwise */
bool
ntlm_input (struct ntlmdata ntlm, const char header)
{
if (0 != strncmp (header, "NTLM", 4))
return false;
header += 4;
while (header && c_isspace(header))
header++;
if (*header)
{
ssize_t size;
char buffer = (char ) alloca (strlen (header));
DEBUGP (("Received a type-2 NTLM message.\n"));
size = wget_base64_decode (header, buffer);
if (size < 0)
return false;
...
If header is something like "NTLMQWIK" this code will incorrectly treat this as if header was "NTLM" and try to parse "QWIK" as base64.
In this case, the bug looks to be harmless. However this kind of error occurs in many places in the code, although not all of its uses are incorrect. I have not made any effort to audit the code further to determine if any such misuses are exploitable.
Other places where strn*cmp() functions are misused include wherever content types are compared, e.g.:
http.c: 0 == strncasecmp (type, TEXTHTML_S, strlen (TEXTHTML_S)) ||
(e.g. "text/html_is_not_this_type" will incorrectly match).
Wherever these functions are used, the code should be carefully audited, and except when comparing a prefix of a string is actually what is intended, strncmp should be replaced by strcmp().
|