github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-17 01:36:08 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix invalid read on sql hex decode transformation

Browse Source
This commit is contained in:
Felipe Zimmerle 2016-06-16 10:31:15 -03:00
parent 9919026620
commit e6c542c5b5
No known key found for this signature in database
GPG Key ID: E6DFB08CE8B11277
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/actions/transformations/sql_hex_decode.cc
View File

@ -66,32 +66,38 @@ std::string SqlHexDecode::evaluate(std::string value,
int SqlHexDecode::inplace(unsigned char *data, int len) { int SqlHexDecode::inplace(unsigned char *data, int len) {
unsigned char *d, *begin = data; unsigned char *d, *begin = data;
int count = 0;
if ((data == NULL) || (len == 0)) { if ((data == NULL) || (len == 0)) {
return 0; return 0;
} }
for (d = data; *data; *d++ = *data++) { for (d = data; (++count < len) && *data; *d++ = *data++) {
if (*data != '0') { if (*data != '0') {
continue; continue;
} }
++data; ++data;
++count;
if (mytolower(*data) != 'x') { if (mytolower(*data) != 'x') {
data--; data--;
count--;
continue; continue;
} }
data++; data++;
++count;
// Do we need to keep "0x" if no hexa after? // Do we need to keep "0x" if no hexa after?
if (!VALID_HEX(data[0]) || !VALID_HEX(data[1])) { if (!VALID_HEX(data[0]) || !VALID_HEX(data[1])) {
data -= 2; data -= 2;
count -= 2;
continue; continue;
} }
while (VALID_HEX(data[0]) && VALID_HEX(data[1])) { while (VALID_HEX(data[0]) && VALID_HEX(data[1])) {
*d++ = x2c(data); *d++ = x2c(data);
data += 2; data += 2;
count += 2;
} }
} }