[Git][NTPsec/ntpsec][master] ntpd/refclock_zyfer.c:Zyfer continuation chunk buffer overflow

[Matt Selsky (@selsky)]

Matt Selsky pushed to branch master at NTPsec / ntpsec


Commits:
28255fe0 by Gary E. Miller at 2026-07-31T01:34:51+00:00
ntpd/refclock_zyfer.c:Zyfer continuation chunk buffer overflow

- - - - -


1 changed file:

- ntpd/refclock_zyfer.c


Changes:

=====================================
ntpd/refclock_zyfer.c
=====================================
@@ -210,6 +210,22 @@ zyfer_receive(
 		else
 			return;
 	} else {
+                if (pp->lencode < 0 ||
+                    (size_t)pp->lencode >= sizeof(pp->a_lastcode) - 1) {
+                    pp->lencode = 0;
+                    pp->a_lastcode[0] = '\0';
+                    refclock_report(peer, CEVNT_BADREPLY);
+                    return;
+                }
+
+                size_t avail = sizeof(pp->a_lastcode) - (1 + pp->lencode);
+                if (rbufp->recv_length >= avail) {
+                        pp->lencode = 0;
+                        pp->a_lastcode[0] = '\0';
+                        refclock_report(peer, CEVNT_BADREPLY);
+                        return;
+                }
+
 		memcpy(pp->a_lastcode + pp->lencode, p, rbufp->recv_length);
 		pp->lencode += (int)rbufp->recv_length;
 		pp->a_lastcode[pp->lencode] = '\0';



View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/commit/28255fe0fac1cc562ddcbe17da9460dba180a40e

-- 
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/commit/28255fe0fac1cc562ddcbe17da9460dba180a40e
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20260731/fd0a8661/attachment-0001.htm>