|
 |
cde47b |
From 1f6bbceeeeb613cf4d790874bdd1e917a7071159 Mon Sep 17 00:00:00 2001
|
|
|
cde47b |
From: Daiki Ueno <dueno@redhat.com>
|
|
|
cde47b |
Date: Mon, 8 Jul 2019 16:54:56 +0200
|
|
|
cde47b |
Subject: [PATCH] ext/session_ticket: avoid calling memcpy on overlapping
|
|
|
cde47b |
memory areas
|
|
|
cde47b |
|
|
|
cde47b |
In _gnutls_encrypt_session_ticket, ticket.encrypted_state is allocated
|
|
|
cde47b |
from ticket_data->data, thus those memory areas may overlap. Using
|
|
|
cde47b |
memcpy here leads to undefined behavior.
|
|
|
cde47b |
|
|
|
cde47b |
Spotted by valgrind run on ppc64le.
|
|
|
cde47b |
|
|
|
cde47b |
==95231== Source and destination overlap in memcpy(0x47ce3a2, 0x47ce3a2, 160)
|
|
|
cde47b |
==95231== at 0x408A840: memcpy (vg_replace_strmem.c:1023)
|
|
|
cde47b |
==95231== by 0x424EE9F: pack_ticket (session_ticket.c:139)
|
|
|
cde47b |
==95231== by 0x424FA4F: _gnutls_encrypt_session_ticket (session_ticket.c:335)
|
|
|
cde47b |
==95231== by 0x4199E3B: generate_session_ticket (session_ticket.c:249)
|
|
|
cde47b |
==95231== by 0x419A333: _gnutls13_send_session_ticket (session_ticket.c:307)
|
|
|
cde47b |
==95231== by 0x40F8817: _gnutls13_handshake_server (handshake-tls13.c:511)
|
|
|
cde47b |
==95231== by 0x4110DEB: handshake_server (handshake.c:3331)
|
|
|
cde47b |
==95231== by 0x410C70B: gnutls_handshake (handshake.c:2727)
|
|
|
cde47b |
==95231== by 0x10009EBF: retry_handshake (serv.c:1306)
|
|
|
cde47b |
==95231== by 0x1000AB67: tcp_server (serv.c:1500)
|
|
|
cde47b |
==95231== by 0x10009E5B: main (serv.c:1297)
|
|
|
cde47b |
==95231==
|
|
|
cde47b |
|
|
|
cde47b |
Signed-off-by: Daiki Ueno <dueno@redhat.com>
|
|
|
cde47b |
---
|
|
|
cde47b |
lib/ext/session_ticket.c | 6 +++++-
|
|
|
cde47b |
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
cde47b |
|
|
|
cde47b |
diff --git a/lib/ext/session_ticket.c b/lib/ext/session_ticket.c
|
|
|
cde47b |
index 09e240c2d..98db39ff8 100644
|
|
|
cde47b |
--- a/lib/ext/session_ticket.c
|
|
|
cde47b |
+++ b/lib/ext/session_ticket.c
|
|
|
cde47b |
@@ -136,7 +136,11 @@ pack_ticket(const struct ticket_st *ticket, gnutls_datum_t *ticket_data)
|
|
|
cde47b |
_gnutls_write_uint16(ticket->encrypted_state_len, p);
|
|
|
cde47b |
p += 2;
|
|
|
cde47b |
|
|
|
cde47b |
- memcpy(p, ticket->encrypted_state, ticket->encrypted_state_len);
|
|
|
cde47b |
+ /* We use memmove instead of memcpy here because
|
|
|
cde47b |
+ * ticket->encrypted_state is allocated from
|
|
|
cde47b |
+ * ticket_data->data, and thus both memory areas may overlap.
|
|
|
cde47b |
+ */
|
|
|
cde47b |
+ memmove(p, ticket->encrypted_state, ticket->encrypted_state_len);
|
|
|
cde47b |
p += ticket->encrypted_state_len;
|
|
|
cde47b |
|
|
|
cde47b |
memcpy(p, ticket->mac, TICKET_MAC_SIZE);
|
|
|
cde47b |
--
|
|
|
cde47b |
2.21.0
|
|
|
cde47b |
|