|
|
517f18 |
commit d6a86b5e69e46cc283b1e06c92343319beb42e21
|
|
|
517f18 |
Author: Panu Matilainen <pmatilai@redhat.com>
|
|
|
517f18 |
Date: Thu Mar 4 13:21:19 2021 +0200
|
|
|
517f18 |
|
|
|
517f18 |
Be much more careful about copying data from the signature header
|
|
|
517f18 |
|
|
|
517f18 |
Only look for known tags, and ensure correct type and size where known
|
|
|
517f18 |
before copying over. Bump the old arbitrary 16k count limit to 16M limit
|
|
|
517f18 |
though, it's not inconceivable that a package could have that many files.
|
|
|
517f18 |
While at it, ensure none of these tags exist in the main header,
|
|
|
517f18 |
which would confuse us greatly.
|
|
|
517f18 |
|
|
|
517f18 |
This is optimized for backporting ease, upstream can remove redundancies
|
|
|
517f18 |
and further improve checking later.
|
|
|
517f18 |
|
|
|
517f18 |
Reported and initial patches by Demi Marie Obenour.
|
|
|
517f18 |
|
|
|
517f18 |
Fixes: RhBug:1935049, RhBug:1933867, RhBug:1935035, RhBug:1934125, ...
|
|
|
517f18 |
|
|
|
517f18 |
Fixes: CVE-2021-3421, CVE-2021-20271
|
|
|
517f18 |
|
|
|
517f18 |
Combined with e2f1f1931c5ccf3ecbe4e1e12cacb1e17a277776 and backported into
|
|
|
517f18 |
4.14.3
|
|
|
517f18 |
|
|
|
517f18 |
diff -up rpm-4.14.3/lib/package.c.orig rpm-4.14.3/lib/package.c
|
|
|
517f18 |
--- rpm-4.14.3/lib/package.c.orig 2021-05-31 12:32:49.970393976 +0200
|
|
|
517f18 |
+++ rpm-4.14.3/lib/package.c 2021-05-31 13:53:58.250673275 +0200
|
|
|
517f18 |
@@ -31,76 +31,72 @@ struct pkgdata_s {
|
|
|
517f18 |
rpmRC rc;
|
|
|
517f18 |
};
|
|
|
517f18 |
|
|
|
517f18 |
+struct taglate_s {
|
|
|
517f18 |
+ rpmTagVal stag;
|
|
|
517f18 |
+ rpmTagVal xtag;
|
|
|
517f18 |
+ rpm_count_t count;
|
|
|
517f18 |
+ int quirk;
|
|
|
517f18 |
+} const xlateTags[] = {
|
|
|
517f18 |
+ { RPMSIGTAG_SIZE, RPMTAG_SIGSIZE, 1, 0 },
|
|
|
517f18 |
+ { RPMSIGTAG_PGP, RPMTAG_SIGPGP, 0, 0 },
|
|
|
517f18 |
+ { RPMSIGTAG_MD5, RPMTAG_SIGMD5, 16, 0 },
|
|
|
517f18 |
+ { RPMSIGTAG_GPG, RPMTAG_SIGGPG, 0, 0 },
|
|
|
517f18 |
+ /* { RPMSIGTAG_PGP5, RPMTAG_SIGPGP5, 0, 0 }, */ /* long obsolete, dont use */
|
|
|
517f18 |
+ { RPMSIGTAG_PAYLOADSIZE, RPMTAG_ARCHIVESIZE, 1, 1 },
|
|
|
517f18 |
+ { RPMSIGTAG_SHA1, RPMTAG_SHA1HEADER, 1, 0 },
|
|
|
517f18 |
+ { RPMSIGTAG_SHA256, RPMTAG_SHA256HEADER, 1, 0 },
|
|
|
517f18 |
+ { RPMSIGTAG_DSA, RPMTAG_DSAHEADER, 0, 0 },
|
|
|
517f18 |
+ { RPMSIGTAG_RSA, RPMTAG_RSAHEADER, 0, 0 },
|
|
|
517f18 |
+ { RPMSIGTAG_LONGSIZE, RPMTAG_LONGSIGSIZE, 1, 0 },
|
|
|
517f18 |
+ { RPMSIGTAG_LONGARCHIVESIZE, RPMTAG_LONGARCHIVESIZE, 1, 0 },
|
|
|
517f18 |
+ { 0 }
|
|
|
517f18 |
+};
|
|
|
517f18 |
+
|
|
|
517f18 |
/** \ingroup header
|
|
|
517f18 |
* Translate and merge legacy signature tags into header.
|
|
|
517f18 |
* @param h header (dest)
|
|
|
517f18 |
* @param sigh signature header (src)
|
|
|
517f18 |
+ * @return failing tag number, 0 on success
|
|
|
517f18 |
*/
|
|
|
517f18 |
static
|
|
|
517f18 |
-void headerMergeLegacySigs(Header h, Header sigh)
|
|
|
517f18 |
+rpmTagVal headerMergeLegacySigs(Header h, Header sigh, char **msg)
|
|
|
517f18 |
{
|
|
|
517f18 |
- HeaderIterator hi;
|
|
|
517f18 |
+ const struct taglate_s *xl;
|
|
|
517f18 |
struct rpmtd_s td;
|
|
|
517f18 |
|
|
|
517f18 |
- hi = headerInitIterator(sigh);
|
|
|
517f18 |
- for (; headerNext(hi, &td); rpmtdFreeData(&td))
|
|
|
517f18 |
- {
|
|
|
517f18 |
- switch (td.tag) {
|
|
|
517f18 |
- /* XXX Translate legacy signature tag values. */
|
|
|
517f18 |
- case RPMSIGTAG_SIZE:
|
|
|
517f18 |
- td.tag = RPMTAG_SIGSIZE;
|
|
|
517f18 |
- break;
|
|
|
517f18 |
- case RPMSIGTAG_PGP:
|
|
|
517f18 |
- td.tag = RPMTAG_SIGPGP;
|
|
|
517f18 |
- break;
|
|
|
517f18 |
- case RPMSIGTAG_MD5:
|
|
|
517f18 |
- td.tag = RPMTAG_SIGMD5;
|
|
|
517f18 |
- break;
|
|
|
517f18 |
- case RPMSIGTAG_GPG:
|
|
|
517f18 |
- td.tag = RPMTAG_SIGGPG;
|
|
|
517f18 |
- break;
|
|
|
517f18 |
- case RPMSIGTAG_PGP5:
|
|
|
517f18 |
- td.tag = RPMTAG_SIGPGP5;
|
|
|
517f18 |
- break;
|
|
|
517f18 |
- case RPMSIGTAG_PAYLOADSIZE:
|
|
|
517f18 |
- td.tag = RPMTAG_ARCHIVESIZE;
|
|
|
517f18 |
- break;
|
|
|
517f18 |
- case RPMSIGTAG_SHA1:
|
|
|
517f18 |
- case RPMSIGTAG_SHA256:
|
|
|
517f18 |
- case RPMSIGTAG_DSA:
|
|
|
517f18 |
- case RPMSIGTAG_RSA:
|
|
|
517f18 |
- default:
|
|
|
517f18 |
- if (!(td.tag >= HEADER_SIGBASE && td.tag < HEADER_TAGBASE))
|
|
|
517f18 |
+ rpmtdReset(&td);
|
|
|
517f18 |
+ for (xl = xlateTags; xl->stag; xl++) {
|
|
|
517f18 |
+ /* There mustn't be one in the main header */
|
|
|
517f18 |
+ if (headerIsEntry(h, xl->xtag)) {
|
|
|
517f18 |
+ /* Some tags may exist in either header, but never both */
|
|
|
517f18 |
+ if (xl->quirk && !headerIsEntry(sigh, xl->stag))
|
|
|
517f18 |
continue;
|
|
|
517f18 |
break;
|
|
|
517f18 |
}
|
|
|
517f18 |
- if (!headerIsEntry(h, td.tag)) {
|
|
|
517f18 |
- switch (td.type) {
|
|
|
517f18 |
- case RPM_NULL_TYPE:
|
|
|
517f18 |
- continue;
|
|
|
517f18 |
+ if (headerGet(sigh, xl->stag, &td, HEADERGET_RAW|HEADERGET_MINMEM)) {
|
|
|
517f18 |
+ /* Translate legacy tags */
|
|
|
517f18 |
+ if (xl->stag != xl->xtag)
|
|
|
517f18 |
+ td.tag = xl->xtag;
|
|
|
517f18 |
+ /* Ensure type and tag size match expectations */
|
|
|
517f18 |
+ if (td.type != rpmTagGetTagType(td.tag))
|
|
|
517f18 |
break;
|
|
|
517f18 |
- case RPM_CHAR_TYPE:
|
|
|
517f18 |
- case RPM_INT8_TYPE:
|
|
|
517f18 |
- case RPM_INT16_TYPE:
|
|
|
517f18 |
- case RPM_INT32_TYPE:
|
|
|
517f18 |
- case RPM_INT64_TYPE:
|
|
|
517f18 |
- if (td.count != 1)
|
|
|
517f18 |
- continue;
|
|
|
517f18 |
+ if (td.count < 1 || td.count > 16*1024*1024)
|
|
|
517f18 |
break;
|
|
|
517f18 |
- case RPM_STRING_TYPE:
|
|
|
517f18 |
- case RPM_BIN_TYPE:
|
|
|
517f18 |
- if (td.count >= 16*1024)
|
|
|
517f18 |
- continue;
|
|
|
517f18 |
+ if (xl->count && td.count != xl->count)
|
|
|
517f18 |
break;
|
|
|
517f18 |
- case RPM_STRING_ARRAY_TYPE:
|
|
|
517f18 |
- case RPM_I18NSTRING_TYPE:
|
|
|
517f18 |
- continue;
|
|
|
517f18 |
+ if (!headerPut(h, &td, HEADERPUT_DEFAULT))
|
|
|
517f18 |
break;
|
|
|
517f18 |
- }
|
|
|
517f18 |
- (void) headerPut(h, &td, HEADERPUT_DEFAULT);
|
|
|
517f18 |
+ rpmtdFreeData(&td);
|
|
|
517f18 |
}
|
|
|
517f18 |
}
|
|
|
517f18 |
- headerFreeIterator(hi);
|
|
|
517f18 |
+ rpmtdFreeData(&td);
|
|
|
517f18 |
+
|
|
|
517f18 |
+ if (xl->stag) {
|
|
|
517f18 |
+ rasprintf(msg, "invalid signature tag %s (%d)",
|
|
|
517f18 |
+ rpmTagGetName(xl->xtag), xl->xtag);
|
|
|
517f18 |
+ }
|
|
|
517f18 |
+
|
|
|
517f18 |
+ return xl->stag;
|
|
|
517f18 |
}
|
|
|
517f18 |
|
|
|
517f18 |
/**
|
|
|
517f18 |
@@ -363,7 +359,8 @@ rpmRC rpmReadPackageFile(rpmts ts, FD_t
|
|
|
517f18 |
goto exit;
|
|
|
517f18 |
|
|
|
517f18 |
/* Append (and remap) signature tags to the metadata. */
|
|
|
517f18 |
- headerMergeLegacySigs(h, sigh);
|
|
|
517f18 |
+ if (headerMergeLegacySigs(h, sigh, &msg))
|
|
|
517f18 |
+ goto exit;
|
|
|
517f18 |
applyRetrofits(h);
|
|
|
517f18 |
|
|
|
517f18 |
/* Bump reference count for return. */
|