Blame SOURCES/perl-5.31.6-disallow-vstring-magic-strings-over-2GB-1.patch

3165cb
From ea1e86cfdf26a330e58ea377a80273de7110011b Mon Sep 17 00:00:00 2001
3165cb
From: Tony Cook <tony@develop-help.com>
3165cb
Date: Wed, 21 Aug 2019 11:37:58 +1000
3165cb
Subject: [PATCH] disallow vstring magic strings over 2GB-1
3165cb
MIME-Version: 1.0
3165cb
Content-Type: text/plain; charset=UTF-8
3165cb
Content-Transfer-Encoding: 8bit
3165cb
3165cb
On reads this could result in buffer overflows, so avoid writing
3165cb
such large vstrings to avoid causing problems for older Storable.
3165cb
3165cb
Since we no longer write such large vstrings, we don't want to accept
3165cb
them.
3165cb
3165cb
I doubt that restricting versions strings to under 2GB-1 will have
3165cb
a practical effect on downstream users.
3165cb
3165cb
fixes #17306
3165cb
3165cb
Signed-off-by: Petr Písař <ppisar@redhat.com>
3165cb
---
3165cb
 dist/Storable/Storable.xs | 19 ++++++++++++++++---
3165cb
 1 file changed, 16 insertions(+), 3 deletions(-)
3165cb
3165cb
diff --git a/dist/Storable/Storable.xs b/dist/Storable/Storable.xs
3165cb
index c2335680ab..d27ac58012 100644
3165cb
--- a/dist/Storable/Storable.xs
3165cb
+++ b/dist/Storable/Storable.xs
3165cb
@@ -2628,6 +2628,12 @@ static int store_scalar(pTHX_ stcxt_t *cxt, SV *sv)
3165cb
             /* The macro passes this by address, not value, and a lot of
3165cb
                called code assumes that it's 32 bits without checking.  */
3165cb
             const SSize_t len = mg->mg_len;
3165cb
+            /* we no longer accept vstrings over I32_SIZE-1, so don't emit
3165cb
+               them, also, older Storables handle them badly.
3165cb
+            */
3165cb
+            if (len >= I32_MAX) {
3165cb
+                CROAK(("vstring too large to freeze"));
3165cb
+            }
3165cb
             STORE_PV_LEN((const char *)mg->mg_ptr,
3165cb
                          len, SX_VSTRING, SX_LVSTRING);
3165cb
         }
3165cb
@@ -5937,12 +5943,19 @@ static SV *retrieve_lvstring(pTHX_ stcxt_t *cxt, const char *cname)
3165cb
 {
3165cb
 #ifdef SvVOK
3165cb
     char *s;
3165cb
-    I32 len;
3165cb
+    U32 len;
3165cb
     SV *sv;
3165cb
 
3165cb
     RLEN(len);
3165cb
-    TRACEME(("retrieve_lvstring (#%d), len = %" IVdf,
3165cb
-             (int)cxt->tagnum, (IV)len));
3165cb
+    TRACEME(("retrieve_lvstring (#%d), len = %" UVuf,
3165cb
+             (int)cxt->tagnum, (UV)len));
3165cb
+
3165cb
+    /* Since we'll no longer produce such large vstrings, reject them
3165cb
+       here too.
3165cb
+    */
3165cb
+    if (len >= I32_MAX) {
3165cb
+        CROAK(("vstring too large to fetch"));
3165cb
+    }
3165cb
 
3165cb
     New(10003, s, len+1, char);
3165cb
     SAFEPVREAD(s, len, s);
3165cb
-- 
3165cb
2.21.0
3165cb