From patchwork Fri Aug 29 14:32:24 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 384257 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4748214011E for ; Sat, 30 Aug 2014 00:33:10 +1000 (EST) DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:message-id:date:from:mime-version:to:cc :subject:references:in-reply-to:content-type; q=dns; s=default; b= YQjTGyscSUtCVs5xBeLwZ/55qGKzaAWrtF5BbLWtKX/8ZnUsX1YIuqFC9fOalzR/ VK/YYc6fAWVwZLevWdCq8XuloEwXRjm0ABsCnCms0bz2rt7IgrvdH9Pi61ImrNl0 CIPABk8rykmCGJbv4rpxuovkJMtEhYXX+jmhwUA4Z7I= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:message-id:date:from:mime-version:to:cc :subject:references:in-reply-to:content-type; s=default; bh=hzvb tigB8gSyj8yXopoiTdgKnFM=; b=AHMTSJHZwMIhpGMo+dMjrBSPWXerzC6dO2pi UqAiXiOnx8S5Im3eduzTGoypBTsIWUWIIv0RIh1gflN/wq8GIsjiSS8GkohcS8Rn CS+LLAWrat0Qge5YdPSpc9g3bFnK84Ya4fIER38ZQb2+QlShtkZFpxP/EtPWBNsO LpZqQIs= Received: (qmail 13023 invoked by alias); 29 Aug 2014 14:32:59 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 12937 invoked by uid 89); 29 Aug 2014 14:32:44 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-3.3 required=5.0 tests=AWL, BAYES_00, RP_MATCHES_RCVD, SPF_HELO_PASS, SPF_PASS autolearn=ham version=3.3.2 X-HELO: mx1.redhat.com Message-ID: <54008EF8.7030507@redhat.com> Date: Fri, 29 Aug 2014 16:32:24 +0200 From: Florian Weimer User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.7.0 MIME-Version: 1.0 To: Andreas Schwab CC: GNU C Library , azanella@linux.vnet.ibm.com, Allan McRae Subject: Re: [PATCH] Fix crashes on invalid input in IBM gconv modules [BZ #17325] References: <54006E57.8030800@redhat.com> <87y4u7o1yr.fsf@igel.home> In-Reply-To: <87y4u7o1yr.fsf@igel.home> On 08/29/2014 03:33 PM, Andreas Schwab wrote: > Florian Weimer writes: > >> + if (__builtin_expect (rp2->start == 0xffff, 0) \ > > Please use either this > >> + if (__builtin_expect (ch == 0xffff, 0) \ > > or this consistently. Oops, you are right. I went with the first variant, as in the original fix. Retested successfully. Allan, is this okay for master at this stage? From 1819abce68402c06b43621a4168828bb95c40bc1 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Fri, 29 Aug 2014 13:16:49 +0200 Subject: [PATCH] Fix crashes on invalid input in IBM gconv modules [BZ #17325] These changes are based on the fix for BZ #14134 in commit 6e230d11837f3ae7b375ea69d7905f0d18eb79e5. 2014-08-29 Florian Weimer [BZ #17325] * iconvdata/ibm1364.c (BODY): Fix check for sentinel. * iconvdata/ibm932.c (BODY): Replace invalid sentinel check with assert. * iconvdata/ibm933.c (BODY): Fix check for sentinel. * iconvdata/ibm935.c (BODY): Likewise. * iconvdata/ibm937.c (BODY): Likewise. * iconvdata/ibm939.c (BODY): Likewise. * iconvdata/ibm943.c (BODY): Replace invalid sentinel check with assert. * iconvdata/Makefile (iconv-test.out): Pass module list to test script. * iconvdata/run-iconv-test.sh: New test loop for checking for decoder crashers. diff --git a/NEWS b/NEWS index 1af9e70..dd93f2f 100644 --- a/NEWS +++ b/NEWS @@ -23,7 +23,7 @@ Version 2.20 16966, 16967, 16977, 16978, 16984, 16990, 16996, 17009, 17022, 17031, 17042, 17048, 17050, 17058, 17061, 17062, 17069, 17075, 17078, 17079, 17084, 17086, 17088, 17092, 17097, 17125, 17135, 17137, 17150, 17153, - 17187, 17213, 17259, 17261, 17262, 17263, 17319. + 17187, 17213, 17259, 17261, 17262, 17263, 17319, 17325. * Reverted change of ABI data structures for s390 and s390x: On s390 and s390x the size of struct ucontext and jmp_buf was increased in @@ -115,6 +115,11 @@ Version 2.20 normal gconv conversion modules are still supported. Transliteration with //TRANSLIT is still possible, and the //IGNORE specifier continues to be supported. (CVE-2014-5119) + +* Decoding a crafted input sequence in the character sets IBM933, IBM935, + IBM937, IBM939, IBM1364 could result in an out-of-bounds array read, + resulting a denial-of-service security vulnerability in applications which + use functions related to iconv. Version 2.19 diff --git a/iconvdata/Makefile b/iconvdata/Makefile index 0a410a1..b6327d6 100644 --- a/iconvdata/Makefile +++ b/iconvdata/Makefile @@ -297,6 +297,7 @@ $(objpfx)tst-iconv7.out: $(objpfx)gconv-modules \ $(objpfx)iconv-test.out: run-iconv-test.sh $(objpfx)gconv-modules \ $(addprefix $(objpfx),$(modules.so)) \ $(common-objdir)/iconv/iconv_prog TESTS + iconv_modules="$(modules)" \ $(SHELL) $< $(common-objdir) '$(test-wrapper-env)' \ '$(run-program-env)' > $@; \ $(evaluate-test) diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c index 0b5484f..cf80993 100644 --- a/iconvdata/ibm1364.c +++ b/iconvdata/ibm1364.c @@ -221,7 +221,8 @@ enum ++rp2; \ \ uint32_t res; \ - if (__builtin_expect (ch < rp2->start, 0) \ + if (__builtin_expect (rp2->start == 0xffff, 0) \ + || __builtin_expect (ch < rp2->start, 0) \ || (res = DB_TO_UCS4[ch + rp2->idx], \ __builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \ { \ diff --git a/iconvdata/ibm932.c b/iconvdata/ibm932.c index f5dca59..aa69d65 100644 --- a/iconvdata/ibm932.c +++ b/iconvdata/ibm932.c @@ -74,11 +74,12 @@ } \ \ ch = (ch * 0x100) + inptr[1]; \ + /* ch was less than 0xfd. */ \ + assert (ch < 0xfd00); \ while (ch > rp2->end) \ ++rp2; \ \ - if (__builtin_expect (rp2 == NULL, 0) \ - || __builtin_expect (ch < rp2->start, 0) \ + if (__builtin_expect (ch < rp2->start, 0) \ || (res = __ibm932db_to_ucs4[ch + rp2->idx], \ __builtin_expect (res, '\1') == 0 && ch !=0)) \ { \ diff --git a/iconvdata/ibm933.c b/iconvdata/ibm933.c index f46dfb5..461fb5e 100644 --- a/iconvdata/ibm933.c +++ b/iconvdata/ibm933.c @@ -162,7 +162,7 @@ enum while (ch > rp2->end) \ ++rp2; \ \ - if (__builtin_expect (rp2 == NULL, 0) \ + if (__builtin_expect (rp2->start == 0xffff, 0) \ || __builtin_expect (ch < rp2->start, 0) \ || (res = __ibm933db_to_ucs4[ch + rp2->idx], \ __builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \ diff --git a/iconvdata/ibm935.c b/iconvdata/ibm935.c index a8e4e6c..132d816 100644 --- a/iconvdata/ibm935.c +++ b/iconvdata/ibm935.c @@ -162,7 +162,7 @@ enum while (ch > rp2->end) \ ++rp2; \ \ - if (__builtin_expect (rp2 == NULL, 0) \ + if (__builtin_expect (rp2->start == 0xffff, 0) \ || __builtin_expect (ch < rp2->start, 0) \ || (res = __ibm935db_to_ucs4[ch + rp2->idx], \ __builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \ diff --git a/iconvdata/ibm937.c b/iconvdata/ibm937.c index 239be61..69b154d 100644 --- a/iconvdata/ibm937.c +++ b/iconvdata/ibm937.c @@ -162,7 +162,7 @@ enum while (ch > rp2->end) \ ++rp2; \ \ - if (__builtin_expect (rp2 == NULL, 0) \ + if (__builtin_expect (rp2->start == 0xffff, 0) \ || __builtin_expect (ch < rp2->start, 0) \ || (res = __ibm937db_to_ucs4[ch + rp2->idx], \ __builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \ diff --git a/iconvdata/ibm939.c b/iconvdata/ibm939.c index 5d0db36..9936e2c 100644 --- a/iconvdata/ibm939.c +++ b/iconvdata/ibm939.c @@ -162,7 +162,7 @@ enum while (ch > rp2->end) \ ++rp2; \ \ - if (__builtin_expect (rp2 == NULL, 0) \ + if (__builtin_expect (rp2->start == 0xffff, 0) \ || __builtin_expect (ch < rp2->start, 0) \ || (res = __ibm939db_to_ucs4[ch + rp2->idx], \ __builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \ diff --git a/iconvdata/ibm943.c b/iconvdata/ibm943.c index be0c14f..c5d5742 100644 --- a/iconvdata/ibm943.c +++ b/iconvdata/ibm943.c @@ -75,11 +75,12 @@ } \ \ ch = (ch * 0x100) + inptr[1]; \ + /* ch was less than 0xfd. */ \ + assert (ch < 0xfd00); \ while (ch > rp2->end) \ ++rp2; \ \ - if (__builtin_expect (rp2 == NULL, 0) \ - || __builtin_expect (ch < rp2->start, 0) \ + if (__builtin_expect (ch < rp2->start, 0) \ || (res = __ibm943db_to_ucs4[ch + rp2->idx], \ __builtin_expect (res, '\1') == 0 && ch !=0)) \ { \ diff --git a/iconvdata/run-iconv-test.sh b/iconvdata/run-iconv-test.sh index c98c929..5dfb69f 100755 --- a/iconvdata/run-iconv-test.sh +++ b/iconvdata/run-iconv-test.sh @@ -184,6 +184,24 @@ while read utf8 from filename; do done < TESTS2 +# Check for crashes in decoders. +printf '\016\377\377\377\377\377\377\377' > $temp1 +for from in $iconv_modules ; do + echo $ac_n "test decoder $from $ac_c" + PROG=`eval echo $ICONV` + if $PROG < $temp1 >/dev/null 2>&1 ; then + : # fall through + else + status=$? + if test $status -gt 1 ; then + echo "/FAILED" + failed=1 + continue + fi + fi + echo "OK" +done + exit $failed # Local Variables: # mode:shell-script -- 1.9.3