|
 |
a3e2b5 |
From 709214f554355158b2c3e70c7f3424997e002cee Mon Sep 17 00:00:00 2001
|
|
|
a3e2b5 |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
a3e2b5 |
Date: Thu, 23 Aug 2018 14:48:40 +0200
|
|
|
a3e2b5 |
Subject: [PATCH] bus-message: avoid wrap-around when using length read from
|
|
|
a3e2b5 |
message
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
We would read (-1), and then add 1 to it, call message_peek_body(..., 0, ...),
|
|
|
a3e2b5 |
and when trying to make use of the data.
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
The fuzzer test case is just for one site, but they all look similar.
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
v2: fix two UINT8_MAX/UINT32_MAX mismatches founds by LGTM
|
|
|
a3e2b5 |
(cherry picked from commit 902000c19830f5e5a96e8948d691b42e91ecb1e7)
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
Resolves: #1696224
|
|
|
a3e2b5 |
---
|
|
|
a3e2b5 |
src/libsystemd/sd-bus/bus-message.c | 24 ++++++++++++++++++
|
|
|
a3e2b5 |
...h-603dfd98252375ac7dbced53c2ec312671939a36 | Bin 0 -> 40 bytes
|
|
|
a3e2b5 |
2 files changed, 24 insertions(+)
|
|
|
a3e2b5 |
create mode 100644 test/fuzz/fuzz-bus-message/crash-603dfd98252375ac7dbced53c2ec312671939a36
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c
|
|
|
a3e2b5 |
index 613722a1a0..53cbd675b7 100644
|
|
|
a3e2b5 |
--- a/src/libsystemd/sd-bus/bus-message.c
|
|
|
a3e2b5 |
+++ b/src/libsystemd/sd-bus/bus-message.c
|
|
|
a3e2b5 |
@@ -3414,6 +3414,10 @@ _public_ int sd_bus_message_read_basic(sd_bus_message *m, char type, void *p) {
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
l = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
|
|
|
a3e2b5 |
+ if (l == UINT32_MAX)
|
|
|
a3e2b5 |
+ /* avoid overflow right below */
|
|
|
a3e2b5 |
+ return -EBADMSG;
|
|
|
a3e2b5 |
+
|
|
|
a3e2b5 |
r = message_peek_body(m, &rindex, 1, l+1, &q);
|
|
|
a3e2b5 |
if (r < 0)
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
@@ -3436,6 +3440,10 @@ _public_ int sd_bus_message_read_basic(sd_bus_message *m, char type, void *p) {
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
l = *(uint8_t*) q;
|
|
|
a3e2b5 |
+ if (l == UINT8_MAX)
|
|
|
a3e2b5 |
+ /* avoid overflow right below */
|
|
|
a3e2b5 |
+ return -EBADMSG;
|
|
|
a3e2b5 |
+
|
|
|
a3e2b5 |
r = message_peek_body(m, &rindex, 1, l+1, &q);
|
|
|
a3e2b5 |
if (r < 0)
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
@@ -3701,6 +3709,10 @@ static int bus_message_enter_variant(
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
l = *(uint8_t*) q;
|
|
|
a3e2b5 |
+ if (l == UINT8_MAX)
|
|
|
a3e2b5 |
+ /* avoid overflow right below */
|
|
|
a3e2b5 |
+ return -EBADMSG;
|
|
|
a3e2b5 |
+
|
|
|
a3e2b5 |
r = message_peek_body(m, &rindex, 1, l+1, &q);
|
|
|
a3e2b5 |
if (r < 0)
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
@@ -4269,6 +4281,10 @@ _public_ int sd_bus_message_peek_type(sd_bus_message *m, char *type, const char
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
l = *(uint8_t*) q;
|
|
|
a3e2b5 |
+ if (l == UINT8_MAX)
|
|
|
a3e2b5 |
+ /* avoid overflow right below */
|
|
|
a3e2b5 |
+ return -EBADMSG;
|
|
|
a3e2b5 |
+
|
|
|
a3e2b5 |
r = message_peek_body(m, &rindex, 1, l+1, &q);
|
|
|
a3e2b5 |
if (r < 0)
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
@@ -4849,6 +4865,10 @@ static int message_peek_field_string(
|
|
|
a3e2b5 |
if (r < 0)
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
+ if (l == UINT32_MAX)
|
|
|
a3e2b5 |
+ /* avoid overflow right below */
|
|
|
a3e2b5 |
+ return -EBADMSG;
|
|
|
a3e2b5 |
+
|
|
|
a3e2b5 |
r = message_peek_fields(m, ri, 1, l+1, &q);
|
|
|
a3e2b5 |
if (r < 0)
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
@@ -4900,6 +4920,10 @@ static int message_peek_field_signature(
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
l = *(uint8_t*) q;
|
|
|
a3e2b5 |
+ if (l == UINT8_MAX)
|
|
|
a3e2b5 |
+ /* avoid overflow right below */
|
|
|
a3e2b5 |
+ return -EBADMSG;
|
|
|
a3e2b5 |
+
|
|
|
a3e2b5 |
r = message_peek_fields(m, ri, 1, l+1, &q);
|
|
|
a3e2b5 |
if (r < 0)
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
diff --git a/test/fuzz/fuzz-bus-message/crash-603dfd98252375ac7dbced53c2ec312671939a36 b/test/fuzz/fuzz-bus-message/crash-603dfd98252375ac7dbced53c2ec312671939a36
|
|
|
a3e2b5 |
new file mode 100644
|
|
|
a3e2b5 |
index 0000000000000000000000000000000000000000..b3fee9e07af4f925697a549bbc8ffc03a277fac0
|
|
|
a3e2b5 |
GIT binary patch
|
|
|
a3e2b5 |
literal 40
|
|
|
a3e2b5 |
mcmc~{Vqjzdg7laF|BC@>cE)0c{}2$`*K@IKT2AZ~5ElR}@e}O;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
literal 0
|
|
|
a3e2b5 |
HcmV?d00001
|
|
|
a3e2b5 |
|