From 8a5d739eea10ee6e193f053b1662142d5657cbc6 Mon Sep 17 00:00:00 2001 From: Hitendra Prajapati Date: Thu, 6 Oct 2022 09:39:18 +0530 Subject: [PATCH] CVE-2022-2928 Upstream-Status: Backport [https://downloads.isc.org/isc/dhcp/4.4.3-P1/patches/] CVE: CVE-2022-2928 Signed-off-by: Hitendra Prajapati --- common/options.c | 7 +++++ common/tests/option_unittest.c | 54 ++++++++++++++++++++++++++++++++++ 2 files changed, 61 insertions(+) diff --git a/common/options.c b/common/options.c index a7ed84c..4e53bb4 100644 --- a/common/options.c +++ b/common/options.c @@ -4452,6 +4452,8 @@ add_option(struct option_state *options, if (!option_cache_allocate(&oc, MDL)) { log_error("No memory for option cache adding %s (option %d).", option->name, option_num); + /* Get rid of reference created during hash lookup. */ + option_dereference(&option, MDL); return 0; } @@ -4463,6 +4465,8 @@ add_option(struct option_state *options, MDL)) { log_error("No memory for constant data adding %s (option %d).", option->name, option_num); + /* Get rid of reference created during hash lookup. */ + option_dereference(&option, MDL); option_cache_dereference(&oc, MDL); return 0; } @@ -4471,6 +4475,9 @@ add_option(struct option_state *options, save_option(&dhcp_universe, options, oc); option_cache_dereference(&oc, MDL); + /* Get rid of reference created during hash lookup. */ + option_dereference(&option, MDL); + return 1; } diff --git a/common/tests/option_unittest.c b/common/tests/option_unittest.c index cd52cfb..690704d 100644 --- a/common/tests/option_unittest.c +++ b/common/tests/option_unittest.c @@ -130,6 +130,59 @@ ATF_TC_BODY(pretty_print_option, tc) } +ATF_TC(add_option_ref_cnt); + +ATF_TC_HEAD(add_option_ref_cnt, tc) +{ + atf_tc_set_md_var(tc, "descr", + "Verify add_option() does not leak option ref counts."); +} + +ATF_TC_BODY(add_option_ref_cnt, tc) +{ + struct option_state *options = NULL; + struct option *option = NULL; + unsigned int cid_code = DHO_DHCP_CLIENT_IDENTIFIER; + char *cid_str = "1234"; + int refcnt_before = 0; + + // Look up the option we're going to add. + initialize_common_option_spaces(); + if (!option_code_hash_lookup(&option, dhcp_universe.code_hash, + &cid_code, 0, MDL)) { + atf_tc_fail("cannot find option definition?"); + } + + // Get the option's reference count before we call add_options. + refcnt_before = option->refcnt; + + // Allocate a option_state to which to add an option. + if (!option_state_allocate(&options, MDL)) { + atf_tc_fail("cannot allocat options state"); + } + + // Call add_option() to add the option to the option state. + if (!add_option(options, cid_code, cid_str, strlen(cid_str))) { + atf_tc_fail("add_option returned 0"); + } + + // Verify that calling add_option() only adds 1 to the option ref count. + if (option->refcnt != (refcnt_before + 1)) { + atf_tc_fail("after add_option(), count is wrong, before %d, after: %d", + refcnt_before, option->refcnt); + } + + // Derefrence the option_state, this should reduce the ref count to + // it's starting value. + option_state_dereference(&options, MDL); + + // Verify that dereferencing option_state restores option ref count. + if (option->refcnt != refcnt_before) { + atf_tc_fail("after state deref, count is wrong, before %d, after: %d", + refcnt_before, option->refcnt); + } +} + /* This macro defines main() method that will call specified test cases. tp and simple_test_case names can be whatever you want as long as it is a valid variable identifier. */ @@ -137,6 +190,7 @@ ATF_TP_ADD_TCS(tp) { ATF_TP_ADD_TC(tp, option_refcnt); ATF_TP_ADD_TC(tp, pretty_print_option); + ATF_TP_ADD_TC(tp, add_option_ref_cnt); return (atf_no_error()); } -- 2.25.1