Blame SOURCES/0041-Ticket-49471-heap-buffer-overflow-in-ss_unescape.patch

b045b9
From 25844922007eea26f78d18171e51be3aa7b5e949 Mon Sep 17 00:00:00 2001
fb1149
From: Thierry Bordaz <tbordaz@redhat.com>
fb1149
Date: Wed, 6 Dec 2017 15:14:57 +0100
fb1149
Subject: [PATCH] Ticket 49471 - heap-buffer-overflow in ss_unescape
fb1149
fb1149
Bug Description:
fb1149
	Two problems here
fb1149
		- when searching for wildcard and escape char, ss_unescape assumes the string
fb1149
		  is at least 3 chars longs. So memcmp can overflow a shorter string
fb1149
		- while splitting a string into substring pattern, it loops over
fb1149
		  wildcard and can overpass the string end
fb1149
fb1149
Fix Description:
fb1149
	For the first problem, it checks the string size is long enough to memcmp
fb1149
        a wildcard or an escape
fb1149
	For the second it exits from the loop  as soon as the end of the string is reached
fb1149
fb1149
https://pagure.io/389-ds-base/issue/49471
fb1149
fb1149
Reviewed by: William Brown
fb1149
fb1149
Platforms tested: F23
fb1149
fb1149
Flag Day: no
fb1149
fb1149
Doc impact: no
fb1149
fb1149
(cherry picked from commit 5991388ce75fba8885579b769711d57acfd43cd3)
fb1149
---
fb1149
 dirsrvtests/tests/tickets/ticket49471_test.py | 79 +++++++++++++++++++++++++++
b045b9
 ldap/servers/plugins/collation/orfilter.c     | 14 +++--
b045b9
 2 files changed, 87 insertions(+), 6 deletions(-)
fb1149
 create mode 100644 dirsrvtests/tests/tickets/ticket49471_test.py
fb1149
fb1149
diff --git a/dirsrvtests/tests/tickets/ticket49471_test.py b/dirsrvtests/tests/tickets/ticket49471_test.py
fb1149
new file mode 100644
fb1149
index 000000000..0456a5182
fb1149
--- /dev/null
fb1149
+++ b/dirsrvtests/tests/tickets/ticket49471_test.py
fb1149
@@ -0,0 +1,79 @@
fb1149
+import logging
fb1149
+import pytest
fb1149
+import os
fb1149
+import time
fb1149
+import ldap
fb1149
+from lib389._constants import *
fb1149
+from lib389.topologies import topology_st as topo
fb1149
+from lib389 import Entry
fb1149
+
fb1149
+DEBUGGING = os.getenv("DEBUGGING", default=False)
fb1149
+if DEBUGGING:
fb1149
+    logging.getLogger(__name__).setLevel(logging.DEBUG)
fb1149
+else:
fb1149
+    logging.getLogger(__name__).setLevel(logging.INFO)
fb1149
+log = logging.getLogger(__name__)
fb1149
+
fb1149
+
fb1149
+USER_CN='user_'
fb1149
+def _user_get_dn(no):
fb1149
+    cn = '%s%d' % (USER_CN, no)
fb1149
+    dn = 'cn=%s,ou=people,%s' % (cn, SUFFIX)
fb1149
+    return (cn, dn)
fb1149
+
fb1149
+def add_user(server, no, desc='dummy', sleep=True):
fb1149
+    (cn, dn) = _user_get_dn(no)
fb1149
+    log.fatal('Adding user (%s): ' % dn)
fb1149
+    server.add_s(Entry((dn, {'objectclass': ['top', 'person', 'inetuser', 'userSecurityInformation'],
fb1149
+                             'cn': [cn],
fb1149
+                             'description': [desc],
fb1149
+                             'sn': [cn],
fb1149
+                             'description': ['add on that host']})))
fb1149
+    if sleep:
fb1149
+        time.sleep(2)
fb1149
+
fb1149
+def test_ticket49471(topo):
fb1149
+    """Specify a test case purpose or name here
fb1149
+
fb1149
+    :id: 457ab172-9455-4eb2-89a0-150e3de5993f
fb1149
+    :setup: Fill in set up configuration here
fb1149
+    :steps:
fb1149
+        1. Fill in test case steps here
fb1149
+        2. And indent them like this (RST format requirement)
fb1149
+    :expectedresults:
fb1149
+        1. Fill in the result that is expected
fb1149
+        2. For each test step
fb1149
+    """
fb1149
+
fb1149
+    # If you need any test suite initialization,
fb1149
+    # please, write additional fixture for that (including finalizer).
fb1149
+    # Topology for suites are predefined in lib389/topologies.py.
fb1149
+
fb1149
+    # If you need host, port or any other data about instance,
fb1149
+    # Please, use the instance object attributes for that (for example, topo.ms["master1"].serverid)
fb1149
+
fb1149
+    S1 = topo.standalone
fb1149
+    add_user(S1, 1)
fb1149
+
fb1149
+    Filter = "(description:2.16.840.1.113730.3.3.2.1.1.6:=\*on\*)"
fb1149
+    ents = S1.search_s(SUFFIX, ldap.SCOPE_SUBTREE, Filter)
fb1149
+    assert len(ents) == 1
fb1149
+
fb1149
+    #
fb1149
+    # The following is for the test 49491
fb1149
+    # skipped here else it crashes in ASAN
fb1149
+    #Filter = "(description:2.16.840.1.113730.3.3.2.1.1.6:=\*host)"
fb1149
+    #ents = S1.search_s(SUFFIX, ldap.SCOPE_SUBTREE, Filter)
fb1149
+    #assert len(ents) == 1
fb1149
+
fb1149
+    if DEBUGGING:
fb1149
+        # Add debugging steps(if any)...
fb1149
+        pass
fb1149
+
fb1149
+
fb1149
+if __name__ == '__main__':
fb1149
+    # Run isolated
fb1149
+    # -s for DEBUG mode
fb1149
+    CURRENT_FILE = os.path.realpath(__file__)
fb1149
+    pytest.main("-s %s" % CURRENT_FILE)
fb1149
+
fb1149
diff --git a/ldap/servers/plugins/collation/orfilter.c b/ldap/servers/plugins/collation/orfilter.c
b045b9
index 5a2d8a0ab..a98d90219 100644
fb1149
--- a/ldap/servers/plugins/collation/orfilter.c
fb1149
+++ b/ldap/servers/plugins/collation/orfilter.c
b045b9
@@ -313,12 +313,12 @@ ss_unescape(struct berval *val)
b045b9
     char *t = s;
b045b9
     char *limit = s + val->bv_len;
fb1149
     while (s < limit) {
b045b9
-        if (!memcmp(s, "\\2a", 3) ||
b045b9
-            !memcmp(s, "\\2A", 3)) {
fb1149
+        if (((limit - s) >= 3) &&
fb1149
+                (!memcmp(s, "\\2a", 3) || !memcmp(s, "\\2A", 3))) {
b045b9
             *t++ = WILDCARD;
b045b9
             s += 3;
b045b9
-        } else if (!memcmp(s, "\\5c", 3) ||
b045b9
-                   !memcmp(s, "\\5C", 3)) {
fb1149
+        } else if ((limit - s) >= 3 &&
fb1149
+                (!memcmp(s, "\\5c", 3) || !memcmp(s, "\\5C", 3))) {
b045b9
             *t++ = '\\';
b045b9
             s += 3;
b045b9
         } else {
b045b9
@@ -409,13 +409,15 @@ ss_filter_values(struct berval *pattern, int *query_op)
b045b9
         switch (*p) {
b045b9
         case WILDCARD:
b045b9
             result[n++] = ss_filter_value(s, p - s, &val);
b045b9
-            while (++p != plimit && *p == WILDCARD)
b045b9
-                ;
fb1149
+            while (p != plimit && *p == WILDCARD) p++;
b045b9
             s = p;
b045b9
             break;
b045b9
         default:
b045b9
             break;
b045b9
         }
fb1149
+        if (p >= plimit) {
fb1149
+            break;
fb1149
+        }
fb1149
     }
fb1149
     if (p != s || s == plimit) {
b045b9
         result[n++] = ss_filter_value(s, p - s, &val);
fb1149
-- 
fb1149
2.13.6
fb1149