From 344327385fa47fa5bb67a32c237735e6240cfb93 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Tue, 26 Nov 2024 16:12:45 +1100 Subject: [PATCH] range check dir_ndx before use CVE: CVE-2024-12087 Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=344327385fa47fa5bb67a32c237735e6240cfb93] Signed-off-by: Archana Polampalli --- flist.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/flist.c b/flist.c index 847b1054..087f9da6 100644 --- a/flist.c +++ b/flist.c @@ -2585,6 +2585,10 @@ struct file_list *recv_file_list(int f, int dir_ndx) #endif if (inc_recurse && dir_ndx >= 0) { + if (dir_ndx >= dir_flist->used) { + rprintf(FERROR_XFER, "rsync: refusing invalid dir_ndx %u >= %u\n", dir_ndx, dir_flist->used); + exit_cleanup(RERR_PROTOCOL); + } struct file_struct *file = dir_flist->files[dir_ndx]; if (file->flags & FLAG_GOT_DIR_FLIST) { rprintf(FERROR_XFER, "rsync: refusing malicious duplicate flist for dir %d\n", dir_ndx); -- 2.40.0