openssh bugs - May 2011 - [Bug 1903] New: bindresvport_sa() does not validate non-zero struct sockaddr * port is within intended range

https://bugzilla.mindrot.org/show_bug.cgi?id=1903

           Summary: bindresvport_sa() does not validate non-zero struct
                    sockaddr  * port is within intended range
           Product: Portable OpenSSH
           Version: 5.8p2
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Miscellaneous
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: gs-bugzilla.mindrot.org at gluelogic.com


Created attachment 2043
  --> https://bugzilla.mindrot.org/attachment.cgi?id=2043
validate that port provided in struct sockaddr * to bindresvport_sa()
is within valid range

openbsd-compat/bindresvport.c does not validate that the port provided
in struct sockaddr * to bindresvport_sa() is within the valid range of
intended reserved ports.  If the port provided is non-zero, then that
is taken as the starting port.  For values >= IPPORT_RESERVED, it has
the effect of attempting to bind() to that port (higher than the
reserved port range) and then, if that port is in use, tries NPORTS-1
from STARTPORT.  If all ports [STARTPORT,ENDPORT) are in use, ENDPORT
is never tried.  For non-zero values < STARTPORT, there are potentially
many lower ports that are tried, and even the possibility that no ports
within the intended range are tried.  If a free port is found, the
result is bind()ing to a port < IPPORT_RESERVED, but possibly not
within the intended range of ports.

Trivial fix attached:
change 'if (port == 0)' to 'if (port < STARTPORT || port >
ENDPORT)'

Cheers,
Glenn

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1903

--- Comment #1 from Glenn <gs-bugzilla.mindrot.org at gluelogic.com>
2011-05-10 13:53:15 EST ---
openssh appears unaffected since the only use is in sshconnect.c, which
calls rresvport_af() with a parameter that results in bindresvport_sa()
being called with port set to 0 in struct sockaddr *.  port == 0 is
handled properly, as expected, in bindresvport_sa().

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.