1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
From 51464af713d71802e3c6d5ac15f1a95132a354fe Mon Sep 17 00:00:00 2001
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Mon, 20 Feb 2017 11:13:08 +0100
Subject: [PATCH] cdk_pkt_read: enforce packet limits
That ensures that there are no overflows in the subsequent
calculations.
Resolves the oss-fuzz found bug:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420
Relates: #159
CVE: CVE-2017-7869
Upstream-Status: Backport
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
---
lib/opencdk/read-packet.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/lib/opencdk/read-packet.c b/lib/opencdk/read-packet.c
index 8055a63..ead6480 100644
--- a/lib/opencdk/read-packet.c
+++ b/lib/opencdk/read-packet.c
@@ -950,6 +950,7 @@ static cdk_error_t skip_packet(cdk_stream_t inp, size_t pktlen)
return 0;
}
+#define MAX_PACKET_LEN (1<<24)
/**
* cdk_pkt_read:
@@ -1002,6 +1003,13 @@ cdk_error_t cdk_pkt_read(cdk_stream_t inp, cdk_packet_t pkt)
else
read_old_length(inp, ctb, &pktlen, &pktsize);
+ /* enforce limits to ensure that the following calculations
+ * do not overflow */
+ if (pktlen >= MAX_PACKET_LEN || pktsize >= MAX_PACKET_LEN) {
+ _cdk_log_info("cdk_pkt_read: too long packet\n");
+ return gnutls_assert_val(CDK_Inv_Packet);
+ }
+
pkt->pkttype = pkttype;
pkt->pktlen = pktlen;
pkt->pktsize = pktsize + pktlen;
@@ -1026,6 +1034,7 @@ cdk_error_t cdk_pkt_read(cdk_stream_t inp, cdk_packet_t pkt)
break;
case CDK_PKT_USER_ID:
+
pkt->pkt.user_id = cdk_calloc(1, sizeof *pkt->pkt.user_id
+ pkt->pktlen + 1);
if (!pkt->pkt.user_id)
--
libgit2 0.26.0
|
