anitazha / rpms / systemd

Forked from rpms/systemd 3 years ago
Clone

Blame SOURCES/0667-journald-set-a-limit-on-the-number-of-fields-1k.patch

de8967
From 94809b687fbb1c43b07ed8aa966070079cdcb063 Mon Sep 17 00:00:00 2001
de8967
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
de8967
Date: Thu, 3 Jan 2019 16:09:05 +0100
de8967
Subject: [PATCH] journald: set a limit on the number of fields (1k)
de8967
de8967
We allocate a iovec entry for each field, so with many short entries,
de8967
our memory usage and processing time can be large, even with a relatively
de8967
small message size. Let's refuse overly long entries.
de8967
de8967
CVE-2018-16865
de8967
https://bugzilla.redhat.com/show_bug.cgi?id=1653861
de8967
de8967
What from I can see, the problem is not from an alloca, despite what the CVE
de8967
description says, but from the attack multiplication that comes from creating
de8967
many very small iovecs: (void* + size_t) for each three bytes of input
de8967
message.
de8967
de8967
Resolves: #1657792
de8967
---
de8967
 src/journal/journal-file.h    | 3 +++
de8967
 src/journal/journald-native.c | 4 ++++
de8967
 2 files changed, 7 insertions(+)
de8967
de8967
diff --git a/src/journal/journal-file.h b/src/journal/journal-file.h
de8967
index dd8ef52d2..37749c445 100644
de8967
--- a/src/journal/journal-file.h
de8967
+++ b/src/journal/journal-file.h
de8967
@@ -158,6 +158,9 @@ int journal_file_open_reliably(
de8967
  * files without adding too many zeros. */
de8967
 #define OFSfmt "%06"PRIx64
de8967
 
de8967
+/* The maximum number of fields in an entry */
de8967
+#define ENTRY_FIELD_COUNT_MAX 1024
de8967
+
de8967
 static inline bool VALID_REALTIME(uint64_t u) {
de8967
         /* This considers timestamps until the year 3112 valid. That should be plenty room... */
de8967
         return u > 0 && u < (1ULL << 55);
de8967
diff --git a/src/journal/journald-native.c b/src/journal/journald-native.c
de8967
index cf3349393..0c451274f 100644
de8967
--- a/src/journal/journald-native.c
de8967
+++ b/src/journal/journald-native.c
de8967
@@ -134,6 +134,10 @@ void server_process_native_message(
de8967
                 }
de8967
 
de8967
                 /* A property follows */
de8967
+                if (n > ENTRY_FIELD_COUNT_MAX) {
de8967
+                        log_debug("Received an entry that has more than " STRINGIFY(ENTRY_FIELD_COUNT_MAX) " fields, ignoring entry.");
de8967
+                        goto finish;
de8967
+                }
de8967
 
de8967
                 /* n existing properties, 1 new, +1 for _TRANSPORT */
de8967
                 if (!GREEDY_REALLOC(iovec, m, n + 2 + N_IOVEC_META_FIELDS + N_IOVEC_OBJECT_FIELDS)) {