author | Yiteng Zhang <yiteng.zhang@oracle.com> |
Tue, 07 Feb 2017 17:11:12 -0800 | |
branch | s11u3-sru |
changeset 7654 | 61774c5d9189 |
permissions | -rw-r--r-- |
7654
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
1 |
From 31106a073882656a2a5ab56c4ce2847e9a334c3c Mon Sep 17 00:00:00 2001 |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
2 |
From: Daniel Stenberg <[email protected]> |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
3 |
Date: Wed, 28 Sep 2016 10:15:34 +0200 |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
4 |
Subject: [PATCH] aprintf: detect wrap-around when growing allocation |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
5 |
|
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
6 |
On 32bit systems we could otherwise wrap around after 2GB and allocate 0 |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
7 |
bytes and crash. |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
8 |
|
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
9 |
CVE-2016-8618 |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
10 |
|
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
11 |
Bug: https://curl.haxx.se/docs/adv_20161102D.html |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
12 |
Reported-by: Cure53 |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
13 |
--- |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
14 |
lib/mprintf.c | 9 ++++++--- |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
15 |
1 file changed, 6 insertions(+), 3 deletions(-) |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
16 |
|
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
17 |
--- lib/mprintf.c |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
18 |
+++ lib/mprintf.c |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
19 |
@@ -1034,20 +1034,23 @@ static int alloc_addbyter(int output, FILE *data) |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
20 |
} |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
21 |
infop->alloc = 32; |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
22 |
infop->len =0; |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
23 |
} |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
24 |
else if(infop->len+1 >= infop->alloc) { |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
25 |
- char *newptr; |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
26 |
+ char *newptr = NULL; |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
27 |
+ size_t newsize = infop->alloc*2; |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
28 |
|
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
29 |
- newptr = realloc(infop->buffer, infop->alloc*2); |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
30 |
+ /* detect wrap-around or other overflow problems */ |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
31 |
+ if(newsize > infop->alloc) |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
32 |
+ newptr = realloc(infop->buffer, newsize); |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
33 |
|
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
34 |
if(!newptr) { |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
35 |
infop->fail = 1; |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
36 |
return -1; /* fail */ |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
37 |
} |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
38 |
infop->buffer = newptr; |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
39 |
- infop->alloc *= 2; |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
40 |
+ infop->alloc = newsize; |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
41 |
} |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
42 |
|
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
43 |
infop->buffer[ infop->len ] = outc; |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
44 |
|
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
45 |
infop->len++; |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
46 |
-- |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
47 |
2.9.3 |
61774c5d9189
25241371 problem in LIBRARY/CURL
Yiteng Zhang <yiteng.zhang@oracle.com>
parents:
diff
changeset
|
48 |