From b4e6f826d9ddcc2d72eac432746807e1234266db Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Sun, 2 Nov 2025 14:48:55 -0800 Subject: [PATCH] snmptrapd: Fix out-of-bounds trapOid[] accesses Fixes: https://issues.oss-fuzz.com/issues/457106694 Fixes: https://issues.oss-fuzz.com/issues/458668421 Fixes: https://issues.oss-fuzz.com/issues/458876071 CVE: CVE-2025-68615 Upstream: https://github.com/net-snmp/net-snmp/commit/b4e6f826d9ddcc2d72eac432746807e1234266db Signed-off-by: Thomas Perale --- apps/snmptrapd_handlers.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/apps/snmptrapd_handlers.c b/apps/snmptrapd_handlers.c index 6cd126f266..afd93ed0fb 100644 --- a/apps/snmptrapd_handlers.c +++ b/apps/snmptrapd_handlers.c @@ -1112,6 +1112,12 @@ snmp_input(int op, netsnmp_session *session, */ if (pdu->trap_type == SNMP_TRAP_ENTERPRISESPECIFIC) { trapOidLen = pdu->enterprise_length; + /* + * Drop packets that would trigger an out-of-bounds trapOid[] + * access. + */ + if (trapOidLen < 1 || trapOidLen > OID_LENGTH(trapOid) - 2) + return 1; memcpy(trapOid, pdu->enterprise, sizeof(oid) * trapOidLen); if (trapOid[trapOidLen - 1] != 0) { trapOid[trapOidLen++] = 0;