1 files changed, 47 insertions, 0 deletions
diff --git a/debian/patches/tac_add_attrib_pair_arg_cnt_overflow.patch b/debian/patches/tac_add_attrib_pair_arg_cnt_overflow.patch
new file mode 100644
index 0000000..55686ba
--- /dev/null
+++ b/debian/patches/tac_add_attrib_pair_arg_cnt_overflow.patch
@@ -0,0 +1,47 @@
+--- a/libtac/include/libtac.h
++++ b/libtac/include/libtac.h
+@@ -67,6 +67,7 @@
+ #endif
+ 
+ #define TAC_PLUS_ATTRIB_MAX_LEN 255
++#define TAC_PLUS_ATTRIB_MAX_CNT 255
+ 
+ struct tac_attrib {
+     char *attr;
+@@ -105,6 +106,7 @@
+ #define LIBTAC_STATUS_CONN_TIMEOUT    -8
+ #define LIBTAC_STATUS_CONN_ERR        -9
+ #define LIBTAC_STATUS_ATTRIB_TOO_LONG -10
++#define LIBTAC_STATUS_ATTRIB_TOO_MANY -11
+ 
+ /* Runtime flags */
+ 
+--- a/libtac/lib/attrib.c
++++ b/libtac/lib/attrib.c
+@@ -31,6 +31,7 @@
+     struct tac_attrib *a;
+     size_t l1 = strlen(name);
+     size_t l2;
++    unsigned int attr_cnt = 0;
+     int total_len;
+ 
+     if (l1 > TAC_PLUS_ATTRIB_MAX_LEN-1) { /* take sep into account */
+@@ -69,8 +70,17 @@
+     } else {
+         /* find the last allocated block */
+         a = *attr;
+-        while(a->next != NULL)
++        while(a->next != NULL) {
+             a = a->next; /* a holds last allocated block */
++            attr_cnt++;
++        }
++
++        if (attr_cnt+1 >= TAC_PLUS_ATTRIB_MAX_CNT) { /* take new attrib into account */
++            TACSYSLOG((LOG_WARNING,\
++                "%s: Maximum number of attributes exceeded, skipping",\
++                __FUNCTION__))
++            return LIBTAC_STATUS_ATTRIB_TOO_MANY;
++        }
+ 
+         a->next = (struct tac_attrib *) xcalloc(1, sizeof(struct tac_attrib)); 
+         a = a->next; /* set current block pointer to the new one */