From patchwork Tue Jan 16 14:17:01 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 861647 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=2001:4830:134:3::11; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="iPYHYuHf"; dkim-atps=neutral Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zLY7m0Fjnz9sBd for ; Wed, 17 Jan 2018 01:51:16 +1100 (AEDT) Received: from localhost ([::1]:39416 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ebSa2-0004W1-3t for incoming@patchwork.ozlabs.org; Tue, 16 Jan 2018 09:51:14 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50441) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ebS48-00035w-1B for qemu-devel@nongnu.org; Tue, 16 Jan 2018 09:18:18 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ebS3y-0004dF-1F for qemu-devel@nongnu.org; Tue, 16 Jan 2018 09:18:15 -0500 Received: from mail-wr0-x22b.google.com ([2a00:1450:400c:c0c::22b]:42681) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1ebS3x-0004cZ-Or for qemu-devel@nongnu.org; Tue, 16 Jan 2018 09:18:05 -0500 Received: by mail-wr0-x22b.google.com with SMTP id e41so14999974wre.9 for ; Tue, 16 Jan 2018 06:18:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=NuiElajSzgeXVDt9AMv7McYSNQMQBvK/T6lpjB9QZKo=; b=iPYHYuHfTATF23X5rfJJA+Pxi4f3Wvre34LajE1mcFZfpXOUiCVF9zr2oZXejm7hWR X5lM0VjpfWs37aCSkRRdbHxTSvySyXki5q+rZ+gGC5byXWVBToko5sIGLYnpGrD2kXJn upWW1fthJzqtNdq/5NaBP8EOXolPsMeb1UEReHhiwqWd7tnRr2vfDen8F0QbMCQHvvL2 vv29hW/nsEMZ3g8l1tgvqMeZo66X9+9CHbl7ObzSUC9OgH88wh4i6y6Ib1xx8Pn5Br0d 3X4poR7N2J0jj9Zuf6P78sqWPr4USyBo3hcF0Yym16iZRvcwgjgszAiyiZ7/uesFdU+U JRkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references:mime-version:content-transfer-encoding; bh=NuiElajSzgeXVDt9AMv7McYSNQMQBvK/T6lpjB9QZKo=; b=nZyVW4kyX4Y5F1GeOXy2u1Fh4qYNB7rrzhLLCzJhEYpPCnFzVbVcJRuP8YomkfIsQb RJrmBrJPkoDbBtBekqLoVmerjKYWRykoRNSXPp1+NW3NZUHiRgzrkCL4b4phQgsWnUGE TjXnaHd49SCQJxRa1gPPcKpsN6Z//IGAHI0t5KX5pWNar/MxRn2Ca+F5GxnS2bkhk3r7 xJk99hoUBIVtOJdPu2w5gicCzv9n+pga84nWf7J5agSsGijnEtxh3COMTlmkAAOYM9ea WzMLlM2E+/hmCu08x4mqGgi0wJN2Ciq/cQ1kHOCT8hB3Ow+taKDZ8hc2cB+/SCypcuHK YfVw== X-Gm-Message-State: AKwxytcBrFHW9ATYHJ4Js9qrfGVQGjO+4PzgBCu+PQoDww8JN6PbMiK1 2MMHzH8Go7+n1F1fvYrjbzXLN+v1 X-Google-Smtp-Source: ACJfBosK8uUgyQqKSLcgh9Auv/KG8g0r75/mK4g2JSTe8IOw7qztf6NPgu6W+gT83qsqIyz5HNxYlw== X-Received: by 10.223.152.109 with SMTP id v100mr18712413wrb.222.1516112284201; Tue, 16 Jan 2018 06:18:04 -0800 (PST) Received: from 640k.lan (dynamic-adsl-78-12-229-84.clienti.tiscali.it. [78.12.229.84]) by smtp.gmail.com with ESMTPSA id u10sm1537758wrg.6.2018.01.16.06.18.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 16 Jan 2018 06:18:03 -0800 (PST) From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Tue, 16 Jan 2018 15:17:01 +0100 Message-Id: <1516112253-14480-20-git-send-email-pbonzini@redhat.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1516112253-14480-1-git-send-email-pbonzini@redhat.com> References: <1516112253-14480-1-git-send-email-pbonzini@redhat.com> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2a00:1450:400c:c0c::22b Subject: [Qemu-devel] [PULL 19/51] crypto: fix stack-buffer-overflow error X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" From: Marc-AndrĂ© Lureau ASAN complains about: ==8856==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd8a1fe168 at pc 0x561136cb4451 bp 0x7ffd8a1fe130 sp 0x7ffd8a1fd8e0 READ of size 16 at 0x7ffd8a1fe168 thread T0 #0 0x561136cb4450 in __asan_memcpy (/home/elmarco/src/qq/build/tests/test-crypto-ivgen+0x110450) #1 0x561136d2a6a7 in qcrypto_ivgen_essiv_calculate /home/elmarco/src/qq/crypto/ivgen-essiv.c:83:5 #2 0x561136d29af8 in qcrypto_ivgen_calculate /home/elmarco/src/qq/crypto/ivgen.c:72:12 #3 0x561136d07c8e in test_ivgen /home/elmarco/src/qq/tests/test-crypto-ivgen.c:148:5 #4 0x7f77772c3b04 in test_case_run /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2237 #5 0x7f77772c3ec4 in g_test_run_suite_internal /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2321 #6 0x7f77772c3f6d in g_test_run_suite_internal /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2333 #7 0x7f77772c3f6d in g_test_run_suite_internal /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2333 #8 0x7f77772c3f6d in g_test_run_suite_internal /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2333 #9 0x7f77772c4184 in g_test_run_suite /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2408 #10 0x7f77772c2e0d in g_test_run /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:1674 #11 0x561136d0799b in main /home/elmarco/src/qq/tests/test-crypto-ivgen.c:173:12 #12 0x7f77756e6039 in __libc_start_main (/lib64/libc.so.6+0x21039) #13 0x561136c13d89 in _start (/home/elmarco/src/qq/build/tests/test-crypto-ivgen+0x6fd89) Address 0x7ffd8a1fe168 is located in stack of thread T0 at offset 40 in frame #0 0x561136d2a40f in qcrypto_ivgen_essiv_calculate /home/elmarco/src/qq/crypto/ivgen-essiv.c:76 This frame has 1 object(s): [32, 40) 'sector.addr' <== Memory access at offset 40 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/elmarco/src/qq/build/tests/test-crypto-ivgen+0x110450) in __asan_memcpy Shadow bytes around the buggy address: 0x100031437bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100031437be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100031437bf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100031437c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100031437c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x100031437c20: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00[f3]f3 f3 0x100031437c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100031437c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100031437c50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100031437c60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100031437c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb It looks like the rest of the code copes with ndata being larger than sizeof(sector), so limit the memcpy() range. Signed-off-by: Marc-AndrĂ© Lureau Reviewed-by: Daniel P. Berrange Message-Id: <20180104160523.22995-13-marcandre.lureau@redhat.com> Tested-by: Thomas Huth Reviewed-by: Thomas Huth Signed-off-by: Paolo Bonzini --- crypto/ivgen-essiv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/ivgen-essiv.c b/crypto/ivgen-essiv.c index cba20bd..ad4d926 100644 --- a/crypto/ivgen-essiv.c +++ b/crypto/ivgen-essiv.c @@ -79,7 +79,7 @@ static int qcrypto_ivgen_essiv_calculate(QCryptoIVGen *ivgen, uint8_t *data = g_new(uint8_t, ndata); sector = cpu_to_le64(sector); - memcpy(data, (uint8_t *)§or, ndata); + memcpy(data, (uint8_t *)§or, MIN(sizeof(sector), ndata)); if (sizeof(sector) < ndata) { memset(data + sizeof(sector), 0, ndata - sizeof(sector)); }