You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
299 lines
10 KiB
299 lines
10 KiB
6 years ago
|
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||
|
From: Frediano Ziglio <fziglio@redhat.com>
|
||
|
Date: Fri, 18 May 2018 11:41:57 +0100
|
||
|
Subject: [PATCH] Fix flexible array buffer overflow
|
||
|
|
||
|
This is kind of a DoS, possibly flexible array in the protocol
|
||
|
causes the network size check to be ignored due to integer overflows.
|
||
|
|
||
|
The size of flexible array is computed as (message_end - position),
|
||
|
then this size is added to the number of bytes before the array and
|
||
|
this number is used to check if we overflow initial message.
|
||
|
|
||
|
An example is:
|
||
|
|
||
|
message {
|
||
|
uint32 dummy[2];
|
||
|
uint8 data[] @end;
|
||
|
} LenMessage;
|
||
|
|
||
|
which generated this (simplified remove useless code) code:
|
||
|
|
||
|
{ /* data */
|
||
|
data__nelements = message_end - (start + 8);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
}
|
||
|
|
||
|
nw_size = 8 + data__nw_size;
|
||
|
|
||
|
/* Check if message fits in reported side */
|
||
|
if (nw_size > (uintptr_t) (message_end - start)) {
|
||
|
return NULL;
|
||
|
}
|
||
|
|
||
|
Following code:
|
||
|
- data__nelements == message_end - (start + 8)
|
||
|
- data__nw_size == data__nelements == message_end - (start + 8)
|
||
|
- nw_size == 8 + data__nw_size == 8 + message_end - (start + 8) ==
|
||
|
8 + message_end - start - 8 == message_end -start
|
||
|
- the check for overflow is (nw_size > (message_end - start)) but
|
||
|
nw_size == message_end - start so the check is doing
|
||
|
((message_end - start) > (message_end - start)) which is always false.
|
||
|
|
||
|
If message_end - start < 8 then data__nelements (number of element
|
||
|
on the array above) computation generate an integer underflow that
|
||
|
later create a buffer overflow.
|
||
|
|
||
|
Add a check to make sure that the array starts before the message ends
|
||
|
to avoid the overflow.
|
||
|
|
||
|
Difference is:
|
||
|
diff -u save/generated_client_demarshallers1.c common/generated_client_demarshallers1.c
|
||
|
- - save/generated_client_demarshallers1.c 2018-06-22 22:13:48.626793919 +0100
|
||
|
+ + common/generated_client_demarshallers1.c 2018-06-22 22:14:03.408163291 +0100
|
||
|
@@ -225,6 +225,9 @@
|
||
|
uint64_t data__nelements;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 0) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 0);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
@@ -243,6 +246,9 @@
|
||
|
*free_message = nofree;
|
||
|
return data;
|
||
|
|
||
|
+ error:
|
||
|
+ free(data);
|
||
|
+ return NULL;
|
||
|
}
|
||
|
|
||
|
static uint8_t * parse_msg_set_ack(uint8_t *message_start, uint8_t *message_end, SPICE_GNUC_UNUSED int minor, size_t *size, message_destructor_t *free_message)
|
||
|
@@ -301,6 +307,9 @@
|
||
|
SpiceMsgPing *out;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 12) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 12);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
@@ -5226,6 +5235,9 @@
|
||
|
uint64_t cursor_data__nw_size;
|
||
|
uint64_t cursor_data__nelements;
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start2 + 22) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
cursor_data__nelements = message_end - (start2 + 22);
|
||
|
|
||
|
cursor_data__nw_size = cursor_data__nelements;
|
||
|
@@ -5305,6 +5317,9 @@
|
||
|
uint64_t cursor_data__nw_size;
|
||
|
uint64_t cursor_data__nelements;
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start2 + 22) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
cursor_data__nelements = message_end - (start2 + 22);
|
||
|
|
||
|
cursor_data__nw_size = cursor_data__nelements;
|
||
|
@@ -5540,6 +5555,9 @@
|
||
|
SpiceMsgPlaybackPacket *out;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 4) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 4);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
@@ -5594,6 +5612,9 @@
|
||
|
SpiceMsgPlaybackMode *out;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 8) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 8);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
diff -u save/generated_client_demarshallers.c common/generated_client_demarshallers.c
|
||
|
- - save/generated_client_demarshallers.c 2018-06-22 22:13:48.626793919 +0100
|
||
|
+ + common/generated_client_demarshallers.c 2018-06-22 22:14:03.004153195 +0100
|
||
|
@@ -225,6 +225,9 @@
|
||
|
uint64_t data__nelements;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 0) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 0);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
@@ -243,6 +246,9 @@
|
||
|
*free_message = nofree;
|
||
|
return data;
|
||
|
|
||
|
+ error:
|
||
|
+ free(data);
|
||
|
+ return NULL;
|
||
|
}
|
||
|
|
||
|
static uint8_t * parse_msg_set_ack(uint8_t *message_start, uint8_t *message_end, SPICE_GNUC_UNUSED int minor, size_t *size, message_destructor_t *free_message)
|
||
|
@@ -301,6 +307,9 @@
|
||
|
SpiceMsgPing *out;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 12) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 12);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
@@ -6574,6 +6583,9 @@
|
||
|
}
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start2 + 2 + cursor_u__nw_size) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
cursor_data__nelements = message_end - (start2 + 2 + cursor_u__nw_size);
|
||
|
|
||
|
cursor_data__nw_size = cursor_data__nelements;
|
||
|
@@ -6670,6 +6682,9 @@
|
||
|
}
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start2 + 2 + cursor_u__nw_size) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
cursor_data__nelements = message_end - (start2 + 2 + cursor_u__nw_size);
|
||
|
|
||
|
cursor_data__nw_size = cursor_data__nelements;
|
||
|
@@ -6907,6 +6922,9 @@
|
||
|
SpiceMsgPlaybackPacket *out;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 4) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 4);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
@@ -6961,6 +6979,9 @@
|
||
|
SpiceMsgPlaybackMode *out;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 6) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 6);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
@@ -7559,6 +7580,9 @@
|
||
|
SpiceMsgTunnelSocketData *out;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 2) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 2);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
@@ -7840,6 +7864,9 @@
|
||
|
}
|
||
|
|
||
|
{ /* compressed_data */
|
||
|
+ if (SPICE_UNLIKELY((start + 1 + u__nw_size) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
compressed_data__nelements = message_end - (start + 1 + u__nw_size);
|
||
|
|
||
|
compressed_data__nw_size = compressed_data__nelements;
|
||
|
diff -u save/generated_server_demarshallers.c common/generated_server_demarshallers.c
|
||
|
- - save/generated_server_demarshallers.c 2018-06-22 22:13:48.627793944 +0100
|
||
|
+ + common/generated_server_demarshallers.c 2018-06-22 22:14:05.231208847 +0100
|
||
|
@@ -306,6 +306,9 @@
|
||
|
uint64_t data__nelements;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 0) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 0);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
@@ -324,6 +327,9 @@
|
||
|
*free_message = nofree;
|
||
|
return data;
|
||
|
|
||
|
+ error:
|
||
|
+ free(data);
|
||
|
+ return NULL;
|
||
|
}
|
||
|
|
||
|
static uint8_t * parse_msgc_disconnecting(uint8_t *message_start, uint8_t *message_end, SPICE_GNUC_UNUSED int minor, size_t *size, message_destructor_t *free_message)
|
||
|
@@ -1259,6 +1265,9 @@
|
||
|
SpiceMsgcRecordPacket *out;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 4) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 4);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
@@ -1313,6 +1322,9 @@
|
||
|
SpiceMsgcRecordMode *out;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 6) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 6);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
@@ -1841,6 +1853,9 @@
|
||
|
SpiceMsgcTunnelSocketData *out;
|
||
|
|
||
|
{ /* data */
|
||
|
+ if (SPICE_UNLIKELY((start + 2) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
data__nelements = message_end - (start + 2);
|
||
|
|
||
|
data__nw_size = data__nelements;
|
||
|
@@ -2057,6 +2072,9 @@
|
||
|
}
|
||
|
|
||
|
{ /* compressed_data */
|
||
|
+ if (SPICE_UNLIKELY((start + 1 + u__nw_size) > message_end)) {
|
||
|
+ goto error;
|
||
|
+ }
|
||
|
compressed_data__nelements = message_end - (start + 1 + u__nw_size);
|
||
|
|
||
|
compressed_data__nw_size = compressed_data__nelements;
|
||
|
|
||
|
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
|
||
|
---
|
||
|
spice-common/python_modules/demarshal.py | 1 +
|
||
|
1 file changed, 1 insertion(+)
|
||
|
|
||
|
diff --git a/spice-common/python_modules/demarshal.py b/spice-common/python_modules/demarshal.py
|
||
|
index 1ea131d..7172762 100644
|
||
|
--- a/spice-common/python_modules/demarshal.py
|
||
|
+++ b/spice-common/python_modules/demarshal.py
|
||
|
@@ -318,6 +318,7 @@ def write_validate_array_item(writer, container, item, scope, parent_scope, star
|
||
|
writer.assign(nelements, array.size)
|
||
|
elif array.is_remaining_length():
|
||
|
if element_type.is_fixed_nw_size():
|
||
|
+ writer.error_check("%s > message_end" % item.get_position())
|
||
|
if element_type.get_fixed_nw_size() == 1:
|
||
|
writer.assign(nelements, "message_end - %s" % item.get_position())
|
||
|
else:
|