e5da31
From 89b522ed31837cb2ac107a8961fbb0f2c7fc7ccb Mon Sep 17 00:00:00 2001
e5da31
From: Krzesimir Nowak <qdlacz@gmail.com>
e5da31
Date: Wed, 10 Feb 2021 23:51:07 +0100
e5da31
Subject: [PATCH] gbytearray: Do not accept too large byte arrays
e5da31
e5da31
GByteArray uses guint for storing the length of the byte array, but it
e5da31
also has a constructor (g_byte_array_new_take) that takes length as a
e5da31
gsize. gsize may be larger than guint (64 bits for gsize vs 32 bits
e5da31
for guint). It is possible to call the function with a value greater
e5da31
than G_MAXUINT, which will result in silent length truncation. This
e5da31
may happen as a result of unreffing GBytes into GByteArray, so rather
e5da31
be loud about it.
e5da31
e5da31
(Test case tweaked by Philip Withnall.)
e5da31
---
e5da31
 glib/garray.c      |  6 ++++++
e5da31
 glib/gbytes.c      |  4 ++++
e5da31
 glib/tests/bytes.c | 37 +++++++++++++++++++++++++++++++++++--
e5da31
 3 files changed, 45 insertions(+), 2 deletions(-)
e5da31
e5da31
diff --git a/glib/garray.c b/glib/garray.c
e5da31
index aa3c04707..271d85ad8 100644
e5da31
--- a/glib/garray.c
e5da31
+++ b/glib/garray.c
e5da31
@@ -1666,6 +1666,10 @@ g_byte_array_new (void)
e5da31
  * Create byte array containing the data. The data will be owned by the array
e5da31
  * and will be freed with g_free(), i.e. it could be allocated using g_strdup().
e5da31
  *
e5da31
+ * Do not use it if @len is greater than %G_MAXUINT. #GByteArray
e5da31
+ * stores the length of its data in #guint, which may be shorter than
e5da31
+ * #gsize.
e5da31
+ *
e5da31
  * Since: 2.32
e5da31
  *
e5da31
  * Returns: (transfer full): a new #GByteArray
e5da31
@@ -1677,6 +1681,8 @@ g_byte_array_new_take (guint8 *data,
e5da31
   GByteArray *array;
e5da31
   GRealArray *real;
e5da31
 
e5da31
+  g_return_val_if_fail (len <= G_MAXUINT, NULL);
e5da31
+
e5da31
   array = g_byte_array_new ();
e5da31
   real = (GRealArray *)array;
e5da31
   g_assert (real->data == NULL);
e5da31
diff --git a/glib/gbytes.c b/glib/gbytes.c
e5da31
index 5141170d7..635b79535 100644
e5da31
--- a/glib/gbytes.c
e5da31
+++ b/glib/gbytes.c
e5da31
@@ -512,6 +512,10 @@ g_bytes_unref_to_data (GBytes *bytes,
e5da31
  * g_bytes_new(), g_bytes_new_take() or g_byte_array_free_to_bytes(). In all
e5da31
  * other cases the data is copied.
e5da31
  *
e5da31
+ * Do not use it if @bytes contains more than %G_MAXUINT
e5da31
+ * bytes. #GByteArray stores the length of its data in #guint, which
e5da31
+ * may be shorter than #gsize, that @bytes is using.
e5da31
+ *
e5da31
  * Returns: (transfer full): a new mutable #GByteArray containing the same byte data
e5da31
  *
e5da31
  * Since: 2.32
e5da31
diff --git a/glib/tests/bytes.c b/glib/tests/bytes.c
e5da31
index 5ea5c2b35..42281307b 100644
e5da31
--- a/glib/tests/bytes.c
e5da31
+++ b/glib/tests/bytes.c
e5da31
@@ -10,12 +10,12 @@
e5da31
  */
e5da31
 
e5da31
 #undef G_DISABLE_ASSERT
e5da31
-#undef G_LOG_DOMAIN
e5da31
 
e5da31
 #include <stdio.h>
e5da31
 #include <stdlib.h>
e5da31
 #include <string.h>
e5da31
 #include "glib.h"
e5da31
+#include "glib/gstrfuncsprivate.h"
e5da31
 
e5da31
 /* Keep in sync with glib/gbytes.c */
e5da31
 struct _GBytes
e5da31
@@ -333,6 +333,38 @@ test_to_array_transferred (void)
e5da31
   g_byte_array_unref (array);
e5da31
 }
e5da31
 
e5da31
+static void
e5da31
+test_to_array_transferred_oversize (void)
e5da31
+{
e5da31
+  g_test_message ("g_bytes_unref_to_array() can only take GBytes up to "
e5da31
+                  "G_MAXUINT in length; test that longer ones are rejected");
e5da31
+
e5da31
+  if (sizeof (guint) >= sizeof (gsize))
e5da31
+    {
e5da31
+      g_test_skip ("Skipping test as guint is not smaller than gsize");
e5da31
+    }
e5da31
+  else if (g_test_undefined ())
e5da31
+    {
e5da31
+      GByteArray *array = NULL;
e5da31
+      GBytes *bytes = NULL;
e5da31
+      gpointer data = g_memdup2 (NYAN, N_NYAN);
e5da31
+      gsize len = ((gsize) G_MAXUINT) + 1;
e5da31
+
e5da31
+      bytes = g_bytes_new_take (data, len);
e5da31
+      g_test_expect_message (G_LOG_DOMAIN, G_LOG_LEVEL_CRITICAL,
e5da31
+                             "g_byte_array_new_take: assertion 'len <= G_MAXUINT' failed");
e5da31
+      array = g_bytes_unref_to_array (g_steal_pointer (&bytes));
e5da31
+      g_test_assert_expected_messages ();
e5da31
+      g_assert_null (array);
e5da31
+
e5da31
+      g_free (data);
e5da31
+    }
e5da31
+  else
e5da31
+    {
e5da31
+      g_test_skip ("Skipping test as testing undefined behaviour is disabled");
e5da31
+    }
e5da31
+}
e5da31
+
e5da31
 static void
e5da31
 test_to_array_two_refs (void)
e5da31
 {
e5da31
@@ -407,7 +439,8 @@ main (int argc, char *argv[])
e5da31
   g_test_add_func ("/bytes/to-data/transfered", test_to_data_transferred);
e5da31
   g_test_add_func ("/bytes/to-data/two-refs", test_to_data_two_refs);
e5da31
   g_test_add_func ("/bytes/to-data/non-malloc", test_to_data_non_malloc);
e5da31
-  g_test_add_func ("/bytes/to-array/transfered", test_to_array_transferred);
e5da31
+  g_test_add_func ("/bytes/to-array/transferred", test_to_array_transferred);
e5da31
+  g_test_add_func ("/bytes/to-array/transferred-oversize", test_to_array_transferred_oversize);
e5da31
   g_test_add_func ("/bytes/to-array/two-refs", test_to_array_two_refs);
e5da31
   g_test_add_func ("/bytes/to-array/non-malloc", test_to_array_non_malloc);
e5da31
   g_test_add_func ("/bytes/null", test_null);
e5da31
-- 
e5da31
2.31.1
e5da31