Blame SOURCES/0090-Ticket-49471-heap-buffer-overflow-in-ss_unescape.patch

6f51e1
From 715bdd7fd707d4addf52c21051ec3ab90951a691 Mon Sep 17 00:00:00 2001
816ad1
From: Thierry Bordaz <tbordaz@redhat.com>
816ad1
Date: Wed, 6 Dec 2017 15:14:57 +0100
816ad1
Subject: [PATCH] Ticket 49471 - heap-buffer-overflow in ss_unescape
816ad1
816ad1
Bug Description:
816ad1
	Two problems here
816ad1
		- when searching for wildcard and escape char, ss_unescape assumes the string
816ad1
		  is at least 3 chars longs. So memcmp can overflow a shorter string
816ad1
		- while splitting a string into substring pattern, it loops over
816ad1
		  wildcard and can overpass the string end
816ad1
816ad1
Fix Description:
816ad1
	For the first problem, it checks the string size is long enough to memcmp
816ad1
        a wildcard or an escape
816ad1
	For the second it exits from the loop  as soon as the end of the string is reached
816ad1
816ad1
https://pagure.io/389-ds-base/issue/49471
816ad1
816ad1
Reviewed by: William Brown
816ad1
816ad1
Platforms tested: F23
816ad1
816ad1
Flag Day: no
816ad1
816ad1
Doc impact: no
816ad1
816ad1
(cherry picked from commit 5991388ce75fba8885579b769711d57acfd43cd3)
6f51e1
(cherry picked from commit 3fb1c408cb4065de8d9c0c1de050d08969d51bb0)
816ad1
---
816ad1
 dirsrvtests/tests/tickets/ticket49471_test.py | 79 +++++++++++++++++++++++++++
6f51e1
 ldap/servers/plugins/collation/orfilter.c     | 48 +++++++++-------
6f51e1
 2 files changed, 106 insertions(+), 21 deletions(-)
816ad1
 create mode 100644 dirsrvtests/tests/tickets/ticket49471_test.py
816ad1
816ad1
diff --git a/dirsrvtests/tests/tickets/ticket49471_test.py b/dirsrvtests/tests/tickets/ticket49471_test.py
816ad1
new file mode 100644
816ad1
index 000000000..0456a5182
816ad1
--- /dev/null
816ad1
+++ b/dirsrvtests/tests/tickets/ticket49471_test.py
816ad1
@@ -0,0 +1,79 @@
816ad1
+import logging
816ad1
+import pytest
816ad1
+import os
816ad1
+import time
816ad1
+import ldap
816ad1
+from lib389._constants import *
816ad1
+from lib389.topologies import topology_st as topo
816ad1
+from lib389 import Entry
816ad1
+
816ad1
+DEBUGGING = os.getenv("DEBUGGING", default=False)
816ad1
+if DEBUGGING:
816ad1
+    logging.getLogger(__name__).setLevel(logging.DEBUG)
816ad1
+else:
816ad1
+    logging.getLogger(__name__).setLevel(logging.INFO)
816ad1
+log = logging.getLogger(__name__)
816ad1
+
816ad1
+
816ad1
+USER_CN='user_'
816ad1
+def _user_get_dn(no):
816ad1
+    cn = '%s%d' % (USER_CN, no)
816ad1
+    dn = 'cn=%s,ou=people,%s' % (cn, SUFFIX)
816ad1
+    return (cn, dn)
816ad1
+
816ad1
+def add_user(server, no, desc='dummy', sleep=True):
816ad1
+    (cn, dn) = _user_get_dn(no)
816ad1
+    log.fatal('Adding user (%s): ' % dn)
816ad1
+    server.add_s(Entry((dn, {'objectclass': ['top', 'person', 'inetuser', 'userSecurityInformation'],
816ad1
+                             'cn': [cn],
816ad1
+                             'description': [desc],
816ad1
+                             'sn': [cn],
816ad1
+                             'description': ['add on that host']})))
816ad1
+    if sleep:
816ad1
+        time.sleep(2)
816ad1
+
816ad1
+def test_ticket49471(topo):
816ad1
+    """Specify a test case purpose or name here
816ad1
+
816ad1
+    :id: 457ab172-9455-4eb2-89a0-150e3de5993f
816ad1
+    :setup: Fill in set up configuration here
816ad1
+    :steps:
816ad1
+        1. Fill in test case steps here
816ad1
+        2. And indent them like this (RST format requirement)
816ad1
+    :expectedresults:
816ad1
+        1. Fill in the result that is expected
816ad1
+        2. For each test step
816ad1
+    """
816ad1
+
816ad1
+    # If you need any test suite initialization,
816ad1
+    # please, write additional fixture for that (including finalizer).
816ad1
+    # Topology for suites are predefined in lib389/topologies.py.
816ad1
+
816ad1
+    # If you need host, port or any other data about instance,
816ad1
+    # Please, use the instance object attributes for that (for example, topo.ms["master1"].serverid)
816ad1
+
816ad1
+    S1 = topo.standalone
816ad1
+    add_user(S1, 1)
816ad1
+
816ad1
+    Filter = "(description:2.16.840.1.113730.3.3.2.1.1.6:=\*on\*)"
816ad1
+    ents = S1.search_s(SUFFIX, ldap.SCOPE_SUBTREE, Filter)
816ad1
+    assert len(ents) == 1
816ad1
+
816ad1
+    #
816ad1
+    # The following is for the test 49491
816ad1
+    # skipped here else it crashes in ASAN
816ad1
+    #Filter = "(description:2.16.840.1.113730.3.3.2.1.1.6:=\*host)"
816ad1
+    #ents = S1.search_s(SUFFIX, ldap.SCOPE_SUBTREE, Filter)
816ad1
+    #assert len(ents) == 1
816ad1
+
816ad1
+    if DEBUGGING:
816ad1
+        # Add debugging steps(if any)...
816ad1
+        pass
816ad1
+
816ad1
+
816ad1
+if __name__ == '__main__':
816ad1
+    # Run isolated
816ad1
+    # -s for DEBUG mode
816ad1
+    CURRENT_FILE = os.path.realpath(__file__)
816ad1
+    pytest.main("-s %s" % CURRENT_FILE)
816ad1
+
816ad1
diff --git a/ldap/servers/plugins/collation/orfilter.c b/ldap/servers/plugins/collation/orfilter.c
6f51e1
index 8f10f81b6..438efafef 100644
816ad1
--- a/ldap/servers/plugins/collation/orfilter.c
816ad1
+++ b/ldap/servers/plugins/collation/orfilter.c
6f51e1
@@ -317,19 +317,21 @@ ss_unescape (struct berval* val)
6f51e1
     char* t = s;
6f51e1
     char* limit = s + val->bv_len;
816ad1
     while (s < limit) {
6f51e1
-	if (!memcmp (s, "\\2a", 3) ||
6f51e1
-	    !memcmp (s, "\\2A", 3)) {
6f51e1
-	    *t++ = WILDCARD;
6f51e1
-	    s += 3;
6f51e1
-	} else if (!memcmp (s, "\\5c", 3) ||
6f51e1
-		   !memcmp (s, "\\5C", 3)) {
6f51e1
-	    *t++ = '\\';
6f51e1
-	    s += 3;
6f51e1
-	} else {
6f51e1
-	    if (t == s) LDAP_UTF8INC (t);
6f51e1
-	    else t += LDAP_UTF8COPY (t, s);
6f51e1
-	    LDAP_UTF8INC (s);
6f51e1
-	}
816ad1
+        if (((limit - s) >= 3) &&
816ad1
+                (!memcmp(s, "\\2a", 3) || !memcmp(s, "\\2A", 3))) {
6f51e1
+            *t++ = WILDCARD;
6f51e1
+            s += 3;
816ad1
+        } else if ((limit - s) >= 3 &&
816ad1
+                (!memcmp(s, "\\5c", 3) || !memcmp(s, "\\5C", 3))) {
6f51e1
+            *t++ = '\\';
6f51e1
+            s += 3;
6f51e1
+        } else {
6f51e1
+            if (t == s)
6f51e1
+                LDAP_UTF8INC(t);
6f51e1
+            else
6f51e1
+                t += LDAP_UTF8COPY(t, s);
6f51e1
+            LDAP_UTF8INC(s);
6f51e1
+        }
6f51e1
     }
6f51e1
     val->bv_len = t - val->bv_val;
6f51e1
 }
6f51e1
@@ -405,14 +407,18 @@ ss_filter_values (struct berval* pattern, int* query_op)
6f51e1
     n = 0;
6f51e1
     s = pattern->bv_val;
6f51e1
     for (p = s; p < plimit; LDAP_UTF8INC(p)) {
6f51e1
-	switch (*p) {
6f51e1
-	  case WILDCARD:
6f51e1
-	    result[n++] = ss_filter_value (s, p-s, &val);
6f51e1
-	    while (++p != plimit && *p == WILDCARD);
6f51e1
-	    s = p;
6f51e1
-	    break;
6f51e1
-	  default: break;
6f51e1
-	}
6f51e1
+        switch (*p) {
6f51e1
+        case WILDCARD:
6f51e1
+            result[n++] = ss_filter_value(s, p - s, &val);
816ad1
+            while (p != plimit && *p == WILDCARD) p++;
6f51e1
+            s = p;
6f51e1
+            break;
6f51e1
+        default:
6f51e1
+            break;
6f51e1
+        }
816ad1
+        if (p >= plimit) {
816ad1
+            break;
816ad1
+        }
816ad1
     }
816ad1
     if (p != s || s == plimit) {
6f51e1
 	result[n++] = ss_filter_value (s, p-s, &val);
816ad1
-- 
816ad1
2.13.6
816ad1