|
 |
517f18 |
commit 8f4b3c3cab8922a2022b9e47c71f1ecf906077ef
|
|
|
517f18 |
Author: Demi Marie Obenour <athena@invisiblethingslab.com>
|
|
|
517f18 |
Date: Mon Feb 8 16:05:01 2021 -0500
|
|
|
517f18 |
|
|
|
517f18 |
hdrblobInit() needs bounds checks too
|
|
|
517f18 |
|
|
|
517f18 |
Users can pass untrusted data to hdrblobInit() and it must be robust
|
|
|
517f18 |
against this.
|
|
|
517f18 |
|
|
|
517f18 |
diff --git a/lib/header.c b/lib/header.c
|
|
|
517f18 |
index ea39e679f..ebba9c2b0 100644
|
|
|
517f18 |
--- a/lib/header.c
|
|
|
517f18 |
+++ b/lib/header.c
|
|
|
517f18 |
@@ -11,6 +11,7 @@
|
|
|
517f18 |
#include "system.h"
|
|
|
517f18 |
#include <netdb.h>
|
|
|
517f18 |
#include <errno.h>
|
|
|
517f18 |
+#include <inttypes.h>
|
|
|
517f18 |
#include <rpm/rpmtypes.h>
|
|
|
517f18 |
#include <rpm/rpmstring.h>
|
|
|
517f18 |
#include "lib/header_internal.h"
|
|
|
517f18 |
@@ -1912,6 +1913,25 @@ hdrblob hdrblobFree(hdrblob blob)
|
|
|
517f18 |
return NULL;
|
|
|
517f18 |
}
|
|
|
517f18 |
|
|
|
517f18 |
+static rpmRC hdrblobVerifyLengths(rpmTagVal regionTag, uint32_t il, uint32_t dl,
|
|
|
517f18 |
+ char **emsg) {
|
|
|
517f18 |
+ uint32_t il_max = HEADER_TAGS_MAX;
|
|
|
517f18 |
+ uint32_t dl_max = HEADER_DATA_MAX;
|
|
|
517f18 |
+ if (regionTag == RPMTAG_HEADERSIGNATURES) {
|
|
|
517f18 |
+ il_max = 32;
|
|
|
517f18 |
+ dl_max = 64 * 1024 * 1024;
|
|
|
517f18 |
+ }
|
|
|
517f18 |
+ if (hdrchkRange(il_max, il)) {
|
|
|
517f18 |
+ rasprintf(emsg, _("hdr tags: BAD, no. of tags(%" PRIu32 ") out of range"), il);
|
|
|
517f18 |
+ return RPMRC_FAIL;
|
|
|
517f18 |
+ }
|
|
|
517f18 |
+ if (hdrchkRange(dl_max, dl)) {
|
|
|
517f18 |
+ rasprintf(emsg, _("hdr data: BAD, no. of bytes(%" PRIu32 ") out of range"), dl);
|
|
|
517f18 |
+ return RPMRC_FAIL;
|
|
|
517f18 |
+ }
|
|
|
517f18 |
+ return RPMRC_OK;
|
|
|
517f18 |
+}
|
|
|
517f18 |
+
|
|
|
517f18 |
rpmRC hdrblobRead(FD_t fd, int magic, int exact_size, rpmTagVal regionTag, hdrblob blob, char **emsg)
|
|
|
517f18 |
{
|
|
|
517f18 |
int32_t block[4];
|
|
|
517f18 |
@@ -1924,13 +1944,6 @@ rpmRC hdrblobRead(FD_t fd, int magic, int exact_size, rpmTagVal regionTag, hdrbl
|
|
|
517f18 |
size_t nb;
|
|
|
517f18 |
rpmRC rc = RPMRC_FAIL; /* assume failure */
|
|
|
517f18 |
int xx;
|
|
|
517f18 |
- int32_t il_max = HEADER_TAGS_MAX;
|
|
|
517f18 |
- int32_t dl_max = HEADER_DATA_MAX;
|
|
|
517f18 |
-
|
|
|
517f18 |
- if (regionTag == RPMTAG_HEADERSIGNATURES) {
|
|
|
517f18 |
- il_max = 32;
|
|
|
517f18 |
- dl_max = 64 * 1024 * 1024;
|
|
|
517f18 |
- }
|
|
|
517f18 |
|
|
|
517f18 |
memset(block, 0, sizeof(block));
|
|
|
517f18 |
if ((xx = Freadall(fd, bs, blen)) != blen) {
|
|
|
517f18 |
@@ -1943,15 +1956,9 @@ rpmRC hdrblobRead(FD_t fd, int magic, int exact_size, rpmTagVal regionTag, hdrbl
|
|
|
517f18 |
goto exit;
|
|
|
517f18 |
}
|
|
|
517f18 |
il = ntohl(block[2]);
|
|
|
517f18 |
- if (hdrchkRange(il_max, il)) {
|
|
|
517f18 |
- rasprintf(emsg, _("hdr tags: BAD, no. of tags(%d) out of range"), il);
|
|
|
517f18 |
- goto exit;
|
|
|
517f18 |
- }
|
|
|
517f18 |
dl = ntohl(block[3]);
|
|
|
517f18 |
- if (hdrchkRange(dl_max, dl)) {
|
|
|
517f18 |
- rasprintf(emsg, _("hdr data: BAD, no. of bytes(%d) out of range"), dl);
|
|
|
517f18 |
+ if (hdrblobVerifyLengths(regionTag, il, dl, emsg))
|
|
|
517f18 |
goto exit;
|
|
|
517f18 |
- }
|
|
|
517f18 |
|
|
|
517f18 |
nb = (il * sizeof(struct entryInfo_s)) + dl;
|
|
|
517f18 |
uc = sizeof(il) + sizeof(dl) + nb;
|
|
|
517f18 |
@@ -1995,11 +2002,18 @@ rpmRC hdrblobInit(const void *uh, size_t uc,
|
|
|
517f18 |
struct hdrblob_s *blob, char **emsg)
|
|
|
517f18 |
{
|
|
|
517f18 |
rpmRC rc = RPMRC_FAIL;
|
|
|
517f18 |
-
|
|
|
517f18 |
memset(blob, 0, sizeof(*blob));
|
|
|
517f18 |
+ if (uc && uc < 8) {
|
|
|
517f18 |
+ rasprintf(emsg, _("hdr length: BAD"));
|
|
|
517f18 |
+ goto exit;
|
|
|
517f18 |
+ }
|
|
|
517f18 |
+
|
|
|
517f18 |
blob->ei = (int32_t *) uh; /* discards const */
|
|
|
517f18 |
- blob->il = ntohl(blob->ei[0]);
|
|
|
517f18 |
- blob->dl = ntohl(blob->ei[1]);
|
|
|
517f18 |
+ blob->il = ntohl((uint32_t)(blob->ei[0]));
|
|
|
517f18 |
+ blob->dl = ntohl((uint32_t)(blob->ei[1]));
|
|
|
517f18 |
+ if (hdrblobVerifyLengths(regionTag, blob->il, blob->dl, emsg) != RPMRC_OK)
|
|
|
517f18 |
+ goto exit;
|
|
|
517f18 |
+
|
|
|
517f18 |
blob->pe = (entryInfo) &(blob->ei[2]);
|
|
|
517f18 |
blob->pvlen = sizeof(blob->il) + sizeof(blob->dl) +
|
|
|
517f18 |
(blob->il * sizeof(*blob->pe)) + blob->dl;
|