|
 |
eb774e |
From 3b8a7aff228770f4f7b478db606b10cceacea875 Mon Sep 17 00:00:00 2001
|
|
|
eb774e |
From: Simon McVittie <smcv@collabora.com>
|
|
|
eb774e |
Date: Mon, 12 Sep 2022 13:14:18 +0100
|
|
|
eb774e |
Subject: [PATCH] dbus-marshal-validate: Validate length of arrays of
|
|
|
eb774e |
fixed-length items
|
|
|
eb774e |
|
|
|
eb774e |
This fast-path previously did not check that the array was made up
|
|
|
eb774e |
of an integer number of items. This could lead to assertion failures
|
|
|
eb774e |
and out-of-bounds accesses during subsequent message processing (which
|
|
|
eb774e |
assumes that the message has already been validated), particularly after
|
|
|
eb774e |
the addition of _dbus_header_remove_unknown_fields(), which makes it
|
|
|
eb774e |
more likely that dbus-daemon will apply non-trivial edits to messages.
|
|
|
eb774e |
|
|
|
eb774e |
Thanks: Evgeny Vereshchagin
|
|
|
eb774e |
Fixes: e61f13cf "Bug 18064 - more efficient validation for fixed-size type arrays"
|
|
|
eb774e |
Resolves: https://gitlab.freedesktop.org/dbus/dbus/-/issues/413
|
|
|
eb774e |
Resolves: CVE-2022-42011
|
|
|
eb774e |
Signed-off-by: Simon McVittie <smcv@collabora.com>
|
|
|
eb774e |
(cherry picked from commit 079bbf16186e87fb0157adf8951f19864bc2ed69)
|
|
|
eb774e |
(cherry picked from commit b9e6a7523085a2cfceaffca7ba1ab4251f12a984)
|
|
|
eb774e |
---
|
|
|
eb774e |
dbus/dbus-marshal-validate.c | 13 ++++++++++++-
|
|
|
eb774e |
1 file changed, 12 insertions(+), 1 deletion(-)
|
|
|
eb774e |
|
|
|
eb774e |
diff --git a/dbus/dbus-marshal-validate.c b/dbus/dbus-marshal-validate.c
|
|
|
eb774e |
index ae68414dd..7d0d6cf72 100644
|
|
|
eb774e |
--- a/dbus/dbus-marshal-validate.c
|
|
|
eb774e |
+++ b/dbus/dbus-marshal-validate.c
|
|
|
eb774e |
@@ -503,13 +503,24 @@ validate_body_helper (DBusTypeReader *reader,
|
|
|
eb774e |
*/
|
|
|
eb774e |
if (dbus_type_is_fixed (array_elem_type))
|
|
|
eb774e |
{
|
|
|
eb774e |
+ /* Note that fixed-size types all have sizes equal to
|
|
|
eb774e |
+ * their alignments, so this is really the item size. */
|
|
|
eb774e |
+ alignment = _dbus_type_get_alignment (array_elem_type);
|
|
|
eb774e |
+ _dbus_assert (alignment == 1 || alignment == 2 ||
|
|
|
eb774e |
+ alignment == 4 || alignment == 8);
|
|
|
eb774e |
+
|
|
|
eb774e |
+ /* Because the alignment is a power of 2, this is
|
|
|
eb774e |
+ * equivalent to: (claimed_len % alignment) != 0,
|
|
|
eb774e |
+ * but avoids slower integer division */
|
|
|
eb774e |
+ if ((claimed_len & (alignment - 1)) != 0)
|
|
|
eb774e |
+ return DBUS_INVALID_ARRAY_LENGTH_INCORRECT;
|
|
|
eb774e |
+
|
|
|
eb774e |
/* bools need to be handled differently, because they can
|
|
|
eb774e |
* have an invalid value
|
|
|
eb774e |
*/
|
|
|
eb774e |
if (array_elem_type == DBUS_TYPE_BOOLEAN)
|
|
|
eb774e |
{
|
|
|
eb774e |
dbus_uint32_t v;
|
|
|
eb774e |
- alignment = _dbus_type_get_alignment (array_elem_type);
|
|
|
eb774e |
|
|
|
eb774e |
while (p < array_end)
|
|
|
eb774e |
{
|
|
|
eb774e |
--
|
|
|
eb774e |
GitLab
|
|
|
eb774e |
|