CVE-2015-5194 (Other, published 2017-07-21T14:29Z)
Description: value: The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ntp-project/ntp
Files changed:
ChangeLog
ntpd/ntp_parser.c
ntpd/ntp_parser.y
Commit message: [Bug 1593] ntpd abort in free() with logconfig syntax error.


Vulnerable code:
     982,   986,   987,   991,   992,   996,  1011,  1016,  1024,  1025,
    1029,  1030,  1031,  1032,  1036,  1037,  1038,  1048,  1049,  1053,
    1055,  1060,  1062,  1066,  1071,  1072,  1076,  1077,  1081,  1090,
    1091,  1095,  1096,  1105,  1120,  1124,  1125,  1129,  1130,  1134,
    1135,  1139,  1144,  1148,  1152,  1153,  1157,  1162,  1163,  1167,
    1169,  1171,  1173,  1175
			char prefix = (yyvsp[(1) - (1)].String)[0];
			char *type = (yyvsp[(1) - (1)].String) + 1;
			if (prefix != '+' && prefix != '-' && prefix != '=') {
				yyerror("Logconfig prefix is not '+', '-' or '='\n");
			}
			else
				(yyval.Attr_val) = create_attr_sval(prefix, estrdup(type));
#line 1012 "ntp_parser.y"
#line 1017 "ntp_parser.y"
#line 1048 "ntp_parser.y"
#line 1049 "ntp_parser.y"
#line 1054 "ntp_parser.y"
#line 1056 "ntp_parser.y"
#line 1061 "ntp_parser.y"
#line 1067 "ntp_parser.y"
#line 1071 "ntp_parser.y"
#line 1072 "ntp_parser.y"
#line 1076 "ntp_parser.y"
#line 1077 "ntp_parser.y"
#line 1082 "ntp_parser.y"
#line 1090 "ntp_parser.y"
#line 1091 "ntp_parser.y"
#line 1095 "ntp_parser.y"
#line 1106 "ntp_parser.y"
#line 1120 "ntp_parser.y"
#line 1124 "ntp_parser.y"
#line 1125 "ntp_parser.y"
#line 1129 "ntp_parser.y"
#line 1130 "ntp_parser.y"
#line 1134 "ntp_parser.y"
#line 1135 "ntp_parser.y"
#line 1140 "ntp_parser.y"
#line 1144 "ntp_parser.y"
#line 1148 "ntp_parser.y"
#line 1152 "ntp_parser.y"
#line 1153 "ntp_parser.y"
#line 1158 "ntp_parser.y"
#line 1162 "ntp_parser.y"
#line 1163 "ntp_parser.y"
#line 1168 "ntp_parser.y"
#line 1170 "ntp_parser.y"
#line 1172 "ntp_parser.y"
#line 1174 "ntp_parser.y"
#line 1176 "ntp_parser.y"
#line 3826 "ntp_parser.c"
#line 1180 "ntp_parser.y"
			char prefix = $1[0];
			char *type = $1 + 1;
			if (prefix != '+' && prefix != '-' && prefix != '=') {
				yyerror("Logconfig prefix is not '+', '-' or '='\n");
			}
			else
				$$ = create_attr_sval(prefix, estrdup(type));

Fixed code:
* [Bug 1593] ntpd abort in free() with logconfig syntax error.
     982,   986,   987,   991,   992,   996,  1021,  1026,  1034,  1035,
    1039,  1040,  1041,  1042,  1046,  1047,  1048,  1058,  1059,  1063,
    1065,  1070,  1072,  1076,  1081,  1082,  1086,  1087,  1091,  1100,
    1101,  1105,  1106,  1115,  1130,  1134,  1135,  1139,  1140,  1144,
    1145,  1149,  1154,  1158,  1162,  1163,  1167,  1172,  1173,  1177,
    1179,  1181,  1183,  1185
			char	prefix;
			char *	type;
			switch ((yyvsp[(1) - (1)].String)[0]) {
			
			case '+':
			case '-':
			case '=':
				prefix = (yyvsp[(1) - (1)].String)[0];
				type = (yyvsp[(1) - (1)].String) + 1;
				break;
				
			default:
				prefix = '=';
				type = (yyvsp[(1) - (1)].String);
			}	
			
			(yyval.Attr_val) = create_attr_sval(prefix, estrdup(type));
#line 1022 "ntp_parser.y"
#line 1027 "ntp_parser.y"
#line 1058 "ntp_parser.y"
#line 1059 "ntp_parser.y"
#line 1064 "ntp_parser.y"
#line 1066 "ntp_parser.y"
#line 1071 "ntp_parser.y"
#line 1077 "ntp_parser.y"
#line 1081 "ntp_parser.y"
#line 1082 "ntp_parser.y"
#line 1086 "ntp_parser.y"
#line 1087 "ntp_parser.y"
#line 1092 "ntp_parser.y"
#line 1100 "ntp_parser.y"
#line 1101 "ntp_parser.y"
#line 1105 "ntp_parser.y"
#line 1116 "ntp_parser.y"
#line 1130 "ntp_parser.y"
#line 1134 "ntp_parser.y"
#line 1135 "ntp_parser.y"
#line 1139 "ntp_parser.y"
#line 1140 "ntp_parser.y"
#line 1144 "ntp_parser.y"
#line 1145 "ntp_parser.y"
#line 1150 "ntp_parser.y"
#line 1154 "ntp_parser.y"
#line 1158 "ntp_parser.y"
#line 1162 "ntp_parser.y"
#line 1163 "ntp_parser.y"
#line 1168 "ntp_parser.y"
#line 1172 "ntp_parser.y"
#line 1173 "ntp_parser.y"
#line 1178 "ntp_parser.y"
#line 1180 "ntp_parser.y"
#line 1182 "ntp_parser.y"
#line 1184 "ntp_parser.y"
#line 1186 "ntp_parser.y"
#line 3836 "ntp_parser.c"
#line 1190 "ntp_parser.y"
			char	prefix;
			char *	type;
			switch ($1[0]) {
			
			case '+':
			case '-':
			case '=':
				prefix = $1[0];
				type = $1 + 1;
				break;
				
			default:
				prefix = '=';
				type = $1;
			}	
			
			$$ = create_attr_sval(prefix, estrdup(type));