github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-29 19:24:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix for issues in ssn_verify such as infinite loop.

Browse Source
This commit is contained in:
Breno Silva
2012-11-13 15:26:38 -04:00
parent 00b22f0c59
commit 91e5f85cc1
2 changed files with 13 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGES
View File

@@ -29,6 +29,8 @@
* Fixed bug when @strmatch patterns use invalid escape sequence (Thanks Hideaki Hayashi).
* Fixed bugs in @verifySSN (Thanks Hideaki Hayashi).
* The doc/ directory now contains the instructions to access online documentation.
15 Oct 2012 - 2.7.0

25
apache2/re_operators.c
View File

@@ -3170,14 +3170,14 @@ static int ssn_verify(modsec_rec *msr, const char *ssnumber, int len) {
int area, serial, grp;
int sequencial = 0;
int repetitions = 0;
int progression = 0;
char *str_area;
char *str_grp;
char *str_serial;
for (i = 0; i < len; i++) {
if (apr_isdigit(ssnumber[i])) {
num[i] = convert_to_int(ssnumber[i]);
if (digits < 9)
num[digits] = convert_to_int(ssnumber[i]);
digits++;
}
}
@@ -3186,24 +3186,19 @@ static int ssn_verify(modsec_rec *msr, const char *ssnumber, int len) {
if (digits != 9)
goto invalid;
digits = 0;
for (i=0; i < 8; i++) {
if (num[i] == (num[i+1]-1))
sequencial++;
for (i=0; i < len-1; i++) {
progression = (num[i] - (num[i+1]-1));
repetitions = (num[i] - num[i+1]);
if (repetitions != 0 )
sequencial = 1;
if (progression == 0)
digits++;
if (num[i] == num[i+1])
repetitions++;
}
/* We are blocking when all numbers were repeated */
if (sequencial == 0)
/* We are blocking when all numbers were sequencial or repeated */
if (sequencial == 8)
goto invalid;
if (digits == 8)
if (repetitions == 8)
goto invalid;
str_area = apr_psprintf(msr->mp,"%d%d%d",num[0],num[1],num[2]);