Check to prevent snmp request/response oid length more than 128 subids

Hi,
The while loop which extracts subids (=A0while (length > 0 && (*objidlength=
)-- > 0) { ... in asn_parse_objid()) makes *objidlength =3D -1 for OIDs=A0t=
hat contain=A0more than 128 subids.
So=A0need=A0"*objidlenth =3D MAX_OID_LEN;" inside if(0!=3DNULL).
Please give your comment.

Index: snmplib/asn1.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D
RCS file: /cvsroot/net-snmp/net-snmp/snmplib/asn1.c,v
retrieving revision =

diff -u -p -r5.9 asn1.c
@@ -1301,6 +1301,11 @@ asn_parse_objid(u_char * data,
=A0 =A0 =A0 =A0 *oidp++ =3D (oid) subidentifier;
=A0 =A0 }

=A0=A0=A0 if (0 !=3D length) {
=A0=A0=A0=A0=A0=A0=A0 ERROR_MSG("OID length exceeds buffer size");
+=A0=A0=A0=A0 *objidlenth =3D MAX_OID_LEN;
=A0=A0=A0=A0=A0=A0=A0 return NULL;
=A0=A0=A0 }

=A0=A0=A0 /*
=A0 =A0 =A0 * The first two subidentifiers are encoded into the first compo=
nent
=A0 =A0 =A0 * with the value (X * 40) + Y, where:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D


With Regards,
Saif


__________________________________________________ _________ =

Yahoo! For Good. Give and get cool things for free, reduce waste and help o=
ur planet. Plus find hidden Yahoo! treasure =


http://green.yahoo.com/uk/earth-day/

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference =

Don't miss this year's exciting event. There's still time to save $100. =

Use priority code J8TL2D2. =

http://ad.doubleclick.net/clk;198757....sun.com/java=
one
_______________________________________________
Net-snmp-coders mailing list
Net-snmp-coders@lists.sourceforge.net
https://lists.sourceforge.net/lists/...et-snmp-coders