From db24fa7bd40d819af3f7b06d2f2bbd9f7ed66ced Mon Sep 17 00:00:00 2001 From: C Anthony Risinger Date: Mon, 7 Jan 2013 06:24:29 -0600 Subject: [PATCH] defect/sec-sub: Incorrect offset + length used for pkt encryption Off-by-four bug included the (uninitialized) uwsgi protocol header as part of the signed packet during encryption, but *not* decryption, effectively preventing successful subscriptions; omit the header from both sides. --- core/subscription.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/core/subscription.c b/core/subscription.c index 952bad47..9709bae5 100644 --- a/core/subscription.c +++ b/core/subscription.c @@ -543,10 +543,10 @@ void uwsgi_send_subscription(char *udp_address, char *key, size_t keysize, uint8 #ifdef UWSGI_SSL if (sign) { - if (uwsgi_buffer_append_keynum(ub, "unix", 6, (uwsgi_now() + (time_t) cmd) )) goto end; + if (uwsgi_buffer_append_keynum(ub, "unix", 4, (uwsgi_now() + (time_t) cmd) )) goto end; unsigned int signature_len = 0; - char *signature = uwsgi_rsa_sign(sign, ub->buf, ub->pos, &signature_len); + char *signature = uwsgi_rsa_sign(sign, ub->buf + 4, ub->pos - 4, &signature_len); if (signature && signature_len > 0) { if (uwsgi_buffer_append_keyval(ub, "sign", 4, signature, signature_len)) { free(signature); @@ -558,7 +558,7 @@ void uwsgi_send_subscription(char *udp_address, char *key, size_t keysize, uint8 #endif - send_udp_message(224, cmd, udp_address, ub->buf, ub->pos); + send_udp_message(224, cmd, udp_address, ub->buf, ub->pos - 4); end: uwsgi_buffer_destroy(ub); }