Andrew Geissler | c723b72 | 2021-01-08 16:14:09 -0600 | [diff] [blame] | 1 | From 228edd356f03bf62dcf2b1335f25d43c602ee68d Mon Sep 17 00:00:00 2001 |
| 2 | From: Michael Colavita <mcolavita@fb.com> |
| 3 | Date: Thu, 19 Nov 2020 11:44:40 -0500 |
| 4 | Subject: [PATCH] iconv: Fix incorrect UCS4 inner loop bounds (BZ#26923) |
| 5 | |
| 6 | Previously, in UCS4 conversion routines we limit the number of |
| 7 | characters we examine to the minimum of the number of characters in the |
| 8 | input and the number of characters in the output. This is not the |
| 9 | correct behavior when __GCONV_IGNORE_ERRORS is set, as we do not consume |
| 10 | an output character when we skip a code unit. Instead, track the input |
| 11 | and output pointers and terminate the loop when either reaches its |
| 12 | limit. |
| 13 | |
| 14 | This resolves assertion failures when resetting the input buffer in a step of |
| 15 | iconv, which assumes that the input will be fully consumed given sufficient |
| 16 | output space. |
| 17 | |
| 18 | Upstream-Status: Backport [git://sourceware.org/git/glibc.git] |
| 19 | CVE: CVE-2020-29562 |
| 20 | Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> |
| 21 | --- |
| 22 | iconv/Makefile | 2 +- |
| 23 | iconv/gconv_simple.c | 16 ++++---------- |
| 24 | iconv/tst-iconv8.c | 50 ++++++++++++++++++++++++++++++++++++++++++++ |
| 25 | 3 files changed, 55 insertions(+), 13 deletions(-) |
| 26 | create mode 100644 iconv/tst-iconv8.c |
| 27 | |
| 28 | diff --git a/iconv/Makefile b/iconv/Makefile |
| 29 | index 30bf996d3a..f9b51e23ec 100644 |
| 30 | --- a/iconv/Makefile |
| 31 | +++ b/iconv/Makefile |
| 32 | @@ -44,7 +44,7 @@ CFLAGS-linereader.c += -DNO_TRANSLITERATION |
| 33 | CFLAGS-simple-hash.c += -I../locale |
| 34 | |
| 35 | tests = tst-iconv1 tst-iconv2 tst-iconv3 tst-iconv4 tst-iconv5 tst-iconv6 \ |
| 36 | - tst-iconv7 tst-iconv-mt tst-iconv-opt |
| 37 | + tst-iconv7 tst-iconv8 tst-iconv-mt tst-iconv-opt |
| 38 | |
| 39 | others = iconv_prog iconvconfig |
| 40 | install-others-programs = $(inst_bindir)/iconv |
| 41 | diff --git a/iconv/gconv_simple.c b/iconv/gconv_simple.c |
| 42 | index d4797fba17..963b29f246 100644 |
| 43 | --- a/iconv/gconv_simple.c |
| 44 | +++ b/iconv/gconv_simple.c |
| 45 | @@ -239,11 +239,9 @@ ucs4_internal_loop (struct __gconv_step *step, |
| 46 | int flags = step_data->__flags; |
| 47 | const unsigned char *inptr = *inptrp; |
| 48 | unsigned char *outptr = *outptrp; |
| 49 | - size_t n_convert = MIN (inend - inptr, outend - outptr) / 4; |
| 50 | int result; |
| 51 | - size_t cnt; |
| 52 | |
| 53 | - for (cnt = 0; cnt < n_convert; ++cnt, inptr += 4) |
| 54 | + for (; inptr + 4 <= inend && outptr + 4 <= outend; inptr += 4) |
| 55 | { |
| 56 | uint32_t inval; |
| 57 | |
| 58 | @@ -307,11 +305,9 @@ ucs4_internal_loop_unaligned (struct __gconv_step *step, |
| 59 | int flags = step_data->__flags; |
| 60 | const unsigned char *inptr = *inptrp; |
| 61 | unsigned char *outptr = *outptrp; |
| 62 | - size_t n_convert = MIN (inend - inptr, outend - outptr) / 4; |
| 63 | int result; |
| 64 | - size_t cnt; |
| 65 | |
| 66 | - for (cnt = 0; cnt < n_convert; ++cnt, inptr += 4) |
| 67 | + for (; inptr + 4 <= inend && outptr + 4 <= outend; inptr += 4) |
| 68 | { |
| 69 | if (__glibc_unlikely (inptr[0] > 0x80)) |
| 70 | { |
| 71 | @@ -613,11 +609,9 @@ ucs4le_internal_loop (struct __gconv_step *step, |
| 72 | int flags = step_data->__flags; |
| 73 | const unsigned char *inptr = *inptrp; |
| 74 | unsigned char *outptr = *outptrp; |
| 75 | - size_t n_convert = MIN (inend - inptr, outend - outptr) / 4; |
| 76 | int result; |
| 77 | - size_t cnt; |
| 78 | |
| 79 | - for (cnt = 0; cnt < n_convert; ++cnt, inptr += 4) |
| 80 | + for (; inptr + 4 <= inend && outptr + 4 <= outend; inptr += 4) |
| 81 | { |
| 82 | uint32_t inval; |
| 83 | |
| 84 | @@ -684,11 +678,9 @@ ucs4le_internal_loop_unaligned (struct __gconv_step *step, |
| 85 | int flags = step_data->__flags; |
| 86 | const unsigned char *inptr = *inptrp; |
| 87 | unsigned char *outptr = *outptrp; |
| 88 | - size_t n_convert = MIN (inend - inptr, outend - outptr) / 4; |
| 89 | int result; |
| 90 | - size_t cnt; |
| 91 | |
| 92 | - for (cnt = 0; cnt < n_convert; ++cnt, inptr += 4) |
| 93 | + for (; inptr + 4 <= inend && outptr + 4 <= outend; inptr += 4) |
| 94 | { |
| 95 | if (__glibc_unlikely (inptr[3] > 0x80)) |
| 96 | { |
| 97 | diff --git a/iconv/tst-iconv8.c b/iconv/tst-iconv8.c |
| 98 | new file mode 100644 |
| 99 | index 0000000000..0b92b19f66 |
| 100 | --- /dev/null |
| 101 | +++ b/iconv/tst-iconv8.c |
| 102 | @@ -0,0 +1,50 @@ |
| 103 | +/* Test iconv behavior on UCS4 conversions with //IGNORE. |
| 104 | + Copyright (C) 2020 Free Software Foundation, Inc. |
| 105 | + This file is part of the GNU C Library. |
| 106 | + |
| 107 | + The GNU C Library is free software; you can redistribute it and/or |
| 108 | + modify it under the terms of the GNU Lesser General Public |
| 109 | + License as published by the Free Software Foundation; either |
| 110 | + version 2.1 of the License, or (at your option) any later version. |
| 111 | + |
| 112 | + The GNU C Library is distributed in the hope that it will be useful, |
| 113 | + but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 114 | + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 115 | + Lesser General Public License for more details. |
| 116 | + |
| 117 | + You should have received a copy of the GNU Lesser General Public |
| 118 | + License along with the GNU C Library; if not, see |
| 119 | + <http://www.gnu.org/licenses/>. */ |
| 120 | + |
| 121 | +/* Derived from BZ #26923 */ |
| 122 | +#include <errno.h> |
| 123 | +#include <iconv.h> |
| 124 | +#include <stdio.h> |
| 125 | +#include <support/check.h> |
| 126 | + |
| 127 | +static int |
| 128 | +do_test (void) |
| 129 | +{ |
| 130 | + iconv_t cd = iconv_open ("UTF-8//IGNORE", "ISO-10646/UCS4/"); |
| 131 | + TEST_VERIFY_EXIT (cd != (iconv_t) -1); |
| 132 | + |
| 133 | + /* |
| 134 | + * Convert sequence beginning with an irreversible character into buffer that |
| 135 | + * is too small. |
| 136 | + */ |
| 137 | + char input[12] = "\xe1\x80\xa1" "AAAAAAAAA"; |
| 138 | + char *inptr = input; |
| 139 | + size_t insize = sizeof (input); |
| 140 | + char output[6]; |
| 141 | + char *outptr = output; |
| 142 | + size_t outsize = sizeof (output); |
| 143 | + |
| 144 | + TEST_VERIFY (iconv (cd, &inptr, &insize, &outptr, &outsize) == -1); |
| 145 | + TEST_VERIFY (errno == E2BIG); |
| 146 | + |
| 147 | + TEST_VERIFY_EXIT (iconv_close (cd) != -1); |
| 148 | + |
| 149 | + return 0; |
| 150 | +} |
| 151 | + |
| 152 | +#include <support/test-driver.c> |
| 153 | -- |
| 154 | 2.17.0 |
| 155 | |