debian/patches/extra/0002-tcp_emu-fix-unsafe-snprintf-usages.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
   3 Date: Mon, 27 Jan 2020 10:24:14 +0100
   4 Subject: [PATCH 2/2] tcp_emu: fix unsafe snprintf() usages
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 Various calls to snprintf() assume that snprintf() returns "only" the
  10 number of bytes written (excluding terminating NUL).
  11
  12 https://pubs.opengroup.org/onlinepubs/9699919799/functions/snprintf.html#tag_16_159_04
  13
  14 "Upon successful completion, the snprintf() function shall return the
  15 number of bytes that would be written to s had n been sufficiently
  16 large excluding the terminating null byte."
  17
  18 Before patch ce131029, if there isn't enough room in "m_data" for the
  19 "DCC ..." message, we overflow "m_data".
  20
  21 After the patch, if there isn't enough room for the same, we don't
  22 overflow "m_data", but we set "m_len" out-of-bounds. The next time an
  23 access is bounded by "m_len", we'll have a buffer overflow then.
  24
  25 Use slirp_fmt*() to fix potential OOB memory access.
  26
  27 Reported-by: Laszlo Ersek <lersek@redhat.com>
  28 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
  29 Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
  30 Message-Id: <20200127092414.169796-7-marcandre.lureau@redhat.com>
  31 Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
  32 ---
  33  slirp/src/tcp_subr.c | 44 +++++++++++++++++++++-----------------------
  34  1 file changed, 21 insertions(+), 23 deletions(-)
  35
  36 diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
  37 index d6dd133..93b3488 100644
  38 --- a/slirp/src/tcp_subr.c
  39 +++ b/slirp/src/tcp_subr.c
  40 @@ -655,8 +655,7 @@ int tcp_emu(struct socket *so, struct mbuf *m)
  41                  NTOHS(n1);
  42                  NTOHS(n2);
  43                  m_inc(m, snprintf(NULL, 0, "%d,%d\r\n", n1, n2) + 1);
  44 -                m->m_len = snprintf(m->m_data, M_ROOM(m), "%d,%d\r\n", n1, n2);
  45 -                assert(m->m_len < M_ROOM(m));
  46 +                m->m_len = slirp_fmt(m->m_data, M_ROOM(m), "%d,%d\r\n", n1, n2);
  47              } else {
  48                  *eol = '\r';
  49              }
  50 @@ -696,9 +695,9 @@ int tcp_emu(struct socket *so, struct mbuf *m)
  51              n4 = (laddr & 0xff);
  52
  53              m->m_len = bptr - m->m_data; /* Adjust length */
  54 -            m->m_len += snprintf(bptr, m->m_size - m->m_len,
  55 -                                 "ORT %d,%d,%d,%d,%d,%d\r\n%s", n1, n2, n3, n4,
  56 -                                 n5, n6, x == 7 ? buff : "");
  57 +            m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
  58 +                                  "ORT %d,%d,%d,%d,%d,%d\r\n%s",
  59 +                                  n1, n2, n3, n4, n5, n6, x == 7 ? buff : "");
  60              return 1;
  61          } else if ((bptr = (char *)strstr(m->m_data, "27 Entering")) != NULL) {
  62              /*
  63 @@ -731,11 +730,9 @@ int tcp_emu(struct socket *so, struct mbuf *m)
  64              n4 = (laddr & 0xff);
  65
  66              m->m_len = bptr - m->m_data; /* Adjust length */
  67 -            m->m_len +=
  68 -                snprintf(bptr, m->m_size - m->m_len,
  69 -                         "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
  70 -                         n1, n2, n3, n4, n5, n6, x == 7 ? buff : "");
  71 -
  72 +            m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
  73 +                                  "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
  74 +                                  n1, n2, n3, n4, n5, n6, x == 7 ? buff : "");
  75              return 1;
  76          }
  77
  78 @@ -758,8 +755,8 @@ int tcp_emu(struct socket *so, struct mbuf *m)
  79          if (m->m_data[m->m_len - 1] == '\0' && lport != 0 &&
  80              (so = tcp_listen(slirp, INADDR_ANY, 0, so->so_laddr.s_addr,
  81                               htons(lport), SS_FACCEPTONCE)) != NULL)
  82 -            m->m_len =
  83 -                snprintf(m->m_data, m->m_size, "%d", ntohs(so->so_fport)) + 1;
  84 +            m->m_len = slirp_fmt0(m->m_data, M_ROOM(m),
  85 +                                  "%d", ntohs(so->so_fport));
  86          return 1;
  87
  88      case EMU_IRC:
  89 @@ -778,9 +775,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
  90                  return 1;
  91              }
  92              m->m_len = bptr - m->m_data; /* Adjust length */
  93 -            m->m_len += snprintf(bptr, m->m_size, "DCC CHAT chat %lu %u%c\n",
  94 -                                 (unsigned long)ntohl(so->so_faddr.s_addr),
  95 -                                 ntohs(so->so_fport), 1);
  96 +            m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
  97 +                                  "DCC CHAT chat %lu %u%c\n",
  98 +                                  (unsigned long)ntohl(so->so_faddr.s_addr),
  99 +                                  ntohs(so->so_fport), 1);
 100          } else if (sscanf(bptr, "DCC SEND %256s %u %u %u", buff, &laddr, &lport,
 101                            &n1) == 4) {
 102              if ((so = tcp_listen(slirp, INADDR_ANY, 0, htonl(laddr),
 103 @@ -788,10 +786,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
 104                  return 1;
 105              }
 106              m->m_len = bptr - m->m_data; /* Adjust length */
 107 -            m->m_len +=
 108 -                snprintf(bptr, m->m_size, "DCC SEND %s %lu %u %u%c\n", buff,
 109 -                         (unsigned long)ntohl(so->so_faddr.s_addr),
 110 -                         ntohs(so->so_fport), n1, 1);
 111 +            m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
 112 +                                  "DCC SEND %s %lu %u %u%c\n", buff,
 113 +                                  (unsigned long)ntohl(so->so_faddr.s_addr),
 114 +                                  ntohs(so->so_fport), n1, 1);
 115          } else if (sscanf(bptr, "DCC MOVE %256s %u %u %u", buff, &laddr, &lport,
 116                            &n1) == 4) {
 117              if ((so = tcp_listen(slirp, INADDR_ANY, 0, htonl(laddr),
 118 @@ -799,10 +797,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
 119                  return 1;
 120              }
 121              m->m_len = bptr - m->m_data; /* Adjust length */
 122 -            m->m_len +=
 123 -                snprintf(bptr, m->m_size, "DCC MOVE %s %lu %u %u%c\n", buff,
 124 -                         (unsigned long)ntohl(so->so_faddr.s_addr),
 125 -                         ntohs(so->so_fport), n1, 1);
 126 +            m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
 127 +                                  "DCC MOVE %s %lu %u %u%c\n", buff,
 128 +                                  (unsigned long)ntohl(so->so_faddr.s_addr),
 129 +                                  ntohs(so->so_fport), n1, 1);
 130          }
 131          return 1;
 132
 133 --
 134 2.20.1
 135