|
 |
648606 |
Adjusted lib/package.c section to apply, and 4.11.x requires the
|
|
|
648606 |
same change in lib/signature.c as well.
|
|
|
648606 |
|
|
|
648606 |
From 89dce2b91d7d73a1e225461a7392c3d6d7a30a95 Mon Sep 17 00:00:00 2001
|
|
|
648606 |
From: Panu Matilainen <pmatilai@redhat.com>
|
|
|
648606 |
Date: Wed, 19 Oct 2016 14:48:08 +0300
|
|
|
648606 |
Subject: [PATCH] Verify data is within range and does not overlap in
|
|
|
648606 |
headerVerifyInfo()
|
|
|
648606 |
|
|
|
648606 |
Checking whether data start offset is within header data area is of no use
|
|
|
648606 |
whatsoever if the entire chunk doesn't fit. Validate the entire data
|
|
|
648606 |
fits within range and that it does not overlap, however with string
|
|
|
648606 |
types we can only check the array size is sane but we cant check the
|
|
|
648606 |
actual content.
|
|
|
648606 |
|
|
|
648606 |
Adjust the upper limit for region trailer in headerVerifyRegion() so
|
|
|
648606 |
it fits the new rules, but in reality calling headerVerifyInfo() for
|
|
|
648606 |
the region tags is rather pointless since they're so different.
|
|
|
648606 |
|
|
|
648606 |
Partial fix for RhBug:1373107.
|
|
|
648606 |
---
|
|
|
648606 |
lib/header.c | 21 ++++++++++++++++-----
|
|
|
648606 |
lib/package.c | 2 +-
|
|
|
648606 |
2 files changed, 17 insertions(+), 6 deletions(-)
|
|
|
648606 |
|
|
|
648606 |
diff --git a/lib/header.c b/lib/header.c
|
|
|
648606 |
index 7f7c115..cac5c94 100644
|
|
|
648606 |
--- a/lib/header.c
|
|
|
648606 |
+++ b/lib/header.c
|
|
|
648606 |
@@ -196,7 +196,8 @@ int headerVerifyInfo(int il, int dl, const void * pev, void * iv, int negate)
|
|
|
648606 |
{
|
|
|
648606 |
entryInfo pe = (entryInfo) pev;
|
|
|
648606 |
entryInfo info = iv;
|
|
|
648606 |
- int i;
|
|
|
648606 |
+ int i, tsize;
|
|
|
648606 |
+ int32_t end = 0;
|
|
|
648606 |
|
|
|
648606 |
for (i = 0; i < il; i++) {
|
|
|
648606 |
info->tag = ntohl(pe[i].tag);
|
|
|
648606 |
@@ -206,16 +207,26 @@ int headerVerifyInfo(int il, int dl, const void * pev, void * iv, int negate)
|
|
|
648606 |
info->offset = -info->offset;
|
|
|
648606 |
info->count = ntohl(pe[i].count);
|
|
|
648606 |
|
|
|
648606 |
+ /* Previous data must not overlap */
|
|
|
648606 |
+ if (end > info->offset)
|
|
|
648606 |
+ return i;
|
|
|
648606 |
+
|
|
|
648606 |
if (hdrchkType(info->type))
|
|
|
648606 |
return i;
|
|
|
648606 |
if (hdrchkAlign(info->type, info->offset))
|
|
|
648606 |
return i;
|
|
|
648606 |
- if (hdrchkRange(dl, info->offset))
|
|
|
648606 |
- return i;
|
|
|
648606 |
- if (hdrchkData(info->count))
|
|
|
648606 |
- return i;
|
|
|
648606 |
|
|
|
648606 |
+ /* For string types we can only check the array size is sane */
|
|
|
648606 |
+ tsize = typeSizes[info->type];
|
|
|
648606 |
+ if (tsize < 1)
|
|
|
648606 |
+ tsize = 1;
|
|
|
648606 |
+
|
|
|
648606 |
+ /* Verify the data actually fits */
|
|
|
648606 |
+ end = info->offset + (info->count * tsize);
|
|
|
648606 |
+ if (hdrchkRange(dl, end))
|
|
|
648606 |
+ return i;
|
|
|
648606 |
}
|
|
|
648606 |
+
|
|
|
648606 |
return -1;
|
|
|
648606 |
}
|
|
|
648606 |
|
|
|
648606 |
diff --git a/lib/package.c b/lib/package.c
|
|
|
648606 |
index b6bea09..bb83163 100644
|
|
|
648606 |
--- a/lib/package.c
|
|
|
648606 |
+++ b/lib/package.c
|
|
|
648606 |
@@ -339,7 +339,7 @@ static rpmRC headerVerify(rpmKeyring keyring, rpmVSFlags vsflags,
|
|
|
648606 |
(void) memcpy(&info, regionEnd, REGION_TAG_COUNT);
|
|
|
648606 |
regionEnd += REGION_TAG_COUNT;
|
|
|
648606 |
|
|
|
648606 |
- if (headerVerifyInfo(1, il * sizeof(*pe), &info, &entry.info, 1) != -1 ||
|
|
|
648606 |
+ if (headerVerifyInfo(1, il * sizeof(*pe) + REGION_TAG_COUNT, &info, &entry.info, 1) != -1 ||
|
|
|
648606 |
!(entry.info.tag == RPMTAG_HEADERIMMUTABLE
|
|
|
648606 |
&& entry.info.type == REGION_TAG_TYPE
|
|
|
648606 |
&& entry.info.count == REGION_TAG_COUNT))
|
|
|
648606 |
diff --git a/lib/signature.c b/lib/signature.c
|
|
|
648606 |
index d8017dc..ddf2eb8 100644
|
|
|
648606 |
--- a/lib/signature.c
|
|
|
648606 |
+++ b/lib/signature.c
|
|
|
648606 |
@@ -165,7 +165,7 @@ rpmRC rpmReadSignature(FD_t fd, Header * sighp, sigType sig_type, char ** msg)
|
|
|
648606 |
}
|
|
|
648606 |
dataEnd += REGION_TAG_COUNT;
|
|
|
648606 |
|
|
|
648606 |
- xx = headerVerifyInfo(1, il * sizeof(*pe), &info, &entry.info, 1);
|
|
|
648606 |
+ xx = headerVerifyInfo(1, il * sizeof(*pe) + REGION_TAG_COUNT, &info, &entry.info, 1);
|
|
|
648606 |
if (xx != -1 ||
|
|
|
648606 |
!((entry.info.tag == RPMTAG_HEADERSIGNATURES || entry.info.tag == RPMTAG_HEADERIMAGE)
|
|
|
648606 |
&& entry.info.type == REGION_TAG_TYPE
|