Brad Bishop | c342db3 | 2019-05-15 21:57:59 -0400 | [diff] [blame] | 1 | From 15d47c3bd8551521240bc459fc004c280daef817 Mon Sep 17 00:00:00 2001 |
| 2 | From: "dtucker@openbsd.org" <dtucker@openbsd.org> |
| 3 | Date: Wed, 23 Jan 2019 08:01:46 +0000 |
| 4 | Subject: [PATCH] upstream: Sanitize scp filenames via snmprintf. To do this we |
| 5 | move |
| 6 | |
| 7 | the progressmeter formatting outside of signal handler context and have the |
| 8 | atomicio callback called for EINTR too. bz#2434 with contributions from djm |
| 9 | and jjelen at redhat.com, ok djm@ |
| 10 | |
| 11 | OpenBSD-Commit-ID: 1af61c1f70e4f3bd8ab140b9f1fa699481db57d8 |
| 12 | CVE: CVE-2019-6109 |
| 13 | Upstream-Status: Backport |
| 14 | Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> |
| 15 | --- |
| 16 | atomicio.c | 20 +++++++++++++++----- |
| 17 | progressmeter.c | 53 ++++++++++++++++++++++++----------------------------- |
| 18 | progressmeter.h | 3 ++- |
| 19 | scp.c | 1 + |
| 20 | sftp-client.c | 16 +++++++++------- |
| 21 | 5 files changed, 51 insertions(+), 42 deletions(-) |
| 22 | |
| 23 | diff --git a/atomicio.c b/atomicio.c |
| 24 | index f854a06..d91bd76 100644 |
| 25 | --- a/atomicio.c |
| 26 | +++ b/atomicio.c |
| 27 | @@ -1,4 +1,4 @@ |
| 28 | -/* $OpenBSD: atomicio.c,v 1.28 2016/07/27 23:18:12 djm Exp $ */ |
| 29 | +/* $OpenBSD: atomicio.c,v 1.29 2019/01/23 08:01:46 dtucker Exp $ */ |
| 30 | /* |
| 31 | * Copyright (c) 2006 Damien Miller. All rights reserved. |
| 32 | * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved. |
| 33 | @@ -65,9 +65,14 @@ atomicio6(ssize_t (*f) (int, void *, size_t), int fd, void *_s, size_t n, |
| 34 | res = (f) (fd, s + pos, n - pos); |
| 35 | switch (res) { |
| 36 | case -1: |
| 37 | - if (errno == EINTR) |
| 38 | + if (errno == EINTR) { |
| 39 | + /* possible SIGALARM, update callback */ |
| 40 | + if (cb != NULL && cb(cb_arg, 0) == -1) { |
| 41 | + errno = EINTR; |
| 42 | + return pos; |
| 43 | + } |
| 44 | continue; |
| 45 | - if (errno == EAGAIN || errno == EWOULDBLOCK) { |
| 46 | + } else if (errno == EAGAIN || errno == EWOULDBLOCK) { |
| 47 | #ifndef BROKEN_READ_COMPARISON |
| 48 | (void)poll(&pfd, 1, -1); |
| 49 | #endif |
| 50 | @@ -122,9 +127,14 @@ atomiciov6(ssize_t (*f) (int, const struct iovec *, int), int fd, |
| 51 | res = (f) (fd, iov, iovcnt); |
| 52 | switch (res) { |
| 53 | case -1: |
| 54 | - if (errno == EINTR) |
| 55 | + if (errno == EINTR) { |
| 56 | + /* possible SIGALARM, update callback */ |
| 57 | + if (cb != NULL && cb(cb_arg, 0) == -1) { |
| 58 | + errno = EINTR; |
| 59 | + return pos; |
| 60 | + } |
| 61 | continue; |
| 62 | - if (errno == EAGAIN || errno == EWOULDBLOCK) { |
| 63 | + } else if (errno == EAGAIN || errno == EWOULDBLOCK) { |
| 64 | #ifndef BROKEN_READV_COMPARISON |
| 65 | (void)poll(&pfd, 1, -1); |
| 66 | #endif |
| 67 | diff --git a/progressmeter.c b/progressmeter.c |
| 68 | index fe9bf52..add462d 100644 |
| 69 | --- a/progressmeter.c |
| 70 | +++ b/progressmeter.c |
| 71 | @@ -1,4 +1,4 @@ |
| 72 | -/* $OpenBSD: progressmeter.c,v 1.45 2016/06/30 05:17:05 dtucker Exp $ */ |
| 73 | +/* $OpenBSD: progressmeter.c,v 1.46 2019/01/23 08:01:46 dtucker Exp $ */ |
| 74 | /* |
| 75 | * Copyright (c) 2003 Nils Nordman. All rights reserved. |
| 76 | * |
| 77 | @@ -31,6 +31,7 @@ |
| 78 | |
| 79 | #include <errno.h> |
| 80 | #include <signal.h> |
| 81 | +#include <stdarg.h> |
| 82 | #include <stdio.h> |
| 83 | #include <string.h> |
| 84 | #include <time.h> |
| 85 | @@ -39,6 +40,7 @@ |
| 86 | #include "progressmeter.h" |
| 87 | #include "atomicio.h" |
| 88 | #include "misc.h" |
| 89 | +#include "utf8.h" |
| 90 | |
| 91 | #define DEFAULT_WINSIZE 80 |
| 92 | #define MAX_WINSIZE 512 |
| 93 | @@ -61,7 +63,7 @@ static void setscreensize(void); |
| 94 | void refresh_progress_meter(void); |
| 95 | |
| 96 | /* signal handler for updating the progress meter */ |
| 97 | -static void update_progress_meter(int); |
| 98 | +static void sig_alarm(int); |
| 99 | |
| 100 | static double start; /* start progress */ |
| 101 | static double last_update; /* last progress update */ |
| 102 | @@ -74,6 +76,7 @@ static long stalled; /* how long we have been stalled */ |
| 103 | static int bytes_per_second; /* current speed in bytes per second */ |
| 104 | static int win_size; /* terminal window size */ |
| 105 | static volatile sig_atomic_t win_resized; /* for window resizing */ |
| 106 | +static volatile sig_atomic_t alarm_fired; |
| 107 | |
| 108 | /* units for format_size */ |
| 109 | static const char unit[] = " KMGT"; |
| 110 | @@ -126,9 +129,17 @@ refresh_progress_meter(void) |
| 111 | off_t bytes_left; |
| 112 | int cur_speed; |
| 113 | int hours, minutes, seconds; |
| 114 | - int i, len; |
| 115 | int file_len; |
| 116 | |
| 117 | + if ((!alarm_fired && !win_resized) || !can_output()) |
| 118 | + return; |
| 119 | + alarm_fired = 0; |
| 120 | + |
| 121 | + if (win_resized) { |
| 122 | + setscreensize(); |
| 123 | + win_resized = 0; |
| 124 | + } |
| 125 | + |
| 126 | transferred = *counter - (cur_pos ? cur_pos : start_pos); |
| 127 | cur_pos = *counter; |
| 128 | now = monotime_double(); |
| 129 | @@ -158,16 +169,11 @@ refresh_progress_meter(void) |
| 130 | |
| 131 | /* filename */ |
| 132 | buf[0] = '\0'; |
| 133 | - file_len = win_size - 35; |
| 134 | + file_len = win_size - 36; |
| 135 | if (file_len > 0) { |
| 136 | - len = snprintf(buf, file_len + 1, "\r%s", file); |
| 137 | - if (len < 0) |
| 138 | - len = 0; |
| 139 | - if (len >= file_len + 1) |
| 140 | - len = file_len; |
| 141 | - for (i = len; i < file_len; i++) |
| 142 | - buf[i] = ' '; |
| 143 | - buf[file_len] = '\0'; |
| 144 | + buf[0] = '\r'; |
| 145 | + snmprintf(buf+1, sizeof(buf)-1 , &file_len, "%*s", |
| 146 | + file_len * -1, file); |
| 147 | } |
| 148 | |
| 149 | /* percent of transfer done */ |
| 150 | @@ -228,22 +234,11 @@ refresh_progress_meter(void) |
| 151 | |
| 152 | /*ARGSUSED*/ |
| 153 | static void |
| 154 | -update_progress_meter(int ignore) |
| 155 | +sig_alarm(int ignore) |
| 156 | { |
| 157 | - int save_errno; |
| 158 | - |
| 159 | - save_errno = errno; |
| 160 | - |
| 161 | - if (win_resized) { |
| 162 | - setscreensize(); |
| 163 | - win_resized = 0; |
| 164 | - } |
| 165 | - if (can_output()) |
| 166 | - refresh_progress_meter(); |
| 167 | - |
| 168 | - signal(SIGALRM, update_progress_meter); |
| 169 | + signal(SIGALRM, sig_alarm); |
| 170 | + alarm_fired = 1; |
| 171 | alarm(UPDATE_INTERVAL); |
| 172 | - errno = save_errno; |
| 173 | } |
| 174 | |
| 175 | void |
| 176 | @@ -259,10 +254,9 @@ start_progress_meter(const char *f, off_t filesize, off_t *ctr) |
| 177 | bytes_per_second = 0; |
| 178 | |
| 179 | setscreensize(); |
| 180 | - if (can_output()) |
| 181 | - refresh_progress_meter(); |
| 182 | + refresh_progress_meter(); |
| 183 | |
| 184 | - signal(SIGALRM, update_progress_meter); |
| 185 | + signal(SIGALRM, sig_alarm); |
| 186 | signal(SIGWINCH, sig_winch); |
| 187 | alarm(UPDATE_INTERVAL); |
| 188 | } |
| 189 | @@ -286,6 +280,7 @@ stop_progress_meter(void) |
| 190 | static void |
| 191 | sig_winch(int sig) |
| 192 | { |
| 193 | + signal(SIGWINCH, sig_winch); |
| 194 | win_resized = 1; |
| 195 | } |
| 196 | |
| 197 | diff --git a/progressmeter.h b/progressmeter.h |
| 198 | index bf179dc..8f66780 100644 |
| 199 | --- a/progressmeter.h |
| 200 | +++ b/progressmeter.h |
| 201 | @@ -1,4 +1,4 @@ |
| 202 | -/* $OpenBSD: progressmeter.h,v 1.3 2015/01/14 13:54:13 djm Exp $ */ |
| 203 | +/* $OpenBSD: progressmeter.h,v 1.4 2019/01/23 08:01:46 dtucker Exp $ */ |
| 204 | /* |
| 205 | * Copyright (c) 2002 Nils Nordman. All rights reserved. |
| 206 | * |
| 207 | @@ -24,4 +24,5 @@ |
| 208 | */ |
| 209 | |
| 210 | void start_progress_meter(const char *, off_t, off_t *); |
| 211 | +void refresh_progress_meter(void); |
| 212 | void stop_progress_meter(void); |
| 213 | diff --git a/scp.c b/scp.c |
| 214 | index 4f3fdcd..4a342a6 100644 |
| 215 | --- a/scp.c |
| 216 | +++ b/scp.c |
| 217 | @@ -585,6 +585,7 @@ scpio(void *_cnt, size_t s) |
| 218 | off_t *cnt = (off_t *)_cnt; |
| 219 | |
| 220 | *cnt += s; |
| 221 | + refresh_progress_meter(); |
| 222 | if (limit_kbps > 0) |
| 223 | bandwidth_limit(&bwlimit, s); |
| 224 | return 0; |
| 225 | diff --git a/sftp-client.c b/sftp-client.c |
| 226 | index 4986d6d..2bc698f 100644 |
| 227 | --- a/sftp-client.c |
| 228 | +++ b/sftp-client.c |
| 229 | @@ -101,7 +101,9 @@ sftpio(void *_bwlimit, size_t amount) |
| 230 | { |
| 231 | struct bwlimit *bwlimit = (struct bwlimit *)_bwlimit; |
| 232 | |
| 233 | - bandwidth_limit(bwlimit, amount); |
| 234 | + refresh_progress_meter(); |
| 235 | + if (bwlimit != NULL) |
| 236 | + bandwidth_limit(bwlimit, amount); |
| 237 | return 0; |
| 238 | } |
| 239 | |
| 240 | @@ -121,8 +123,8 @@ send_msg(struct sftp_conn *conn, struct sshbuf *m) |
| 241 | iov[1].iov_base = (u_char *)sshbuf_ptr(m); |
| 242 | iov[1].iov_len = sshbuf_len(m); |
| 243 | |
| 244 | - if (atomiciov6(writev, conn->fd_out, iov, 2, |
| 245 | - conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_out) != |
| 246 | + if (atomiciov6(writev, conn->fd_out, iov, 2, sftpio, |
| 247 | + conn->limit_kbps > 0 ? &conn->bwlimit_out : NULL) != |
| 248 | sshbuf_len(m) + sizeof(mlen)) |
| 249 | fatal("Couldn't send packet: %s", strerror(errno)); |
| 250 | |
| 251 | @@ -138,8 +140,8 @@ get_msg_extended(struct sftp_conn *conn, struct sshbuf *m, int initial) |
| 252 | |
| 253 | if ((r = sshbuf_reserve(m, 4, &p)) != 0) |
| 254 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); |
| 255 | - if (atomicio6(read, conn->fd_in, p, 4, |
| 256 | - conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in) != 4) { |
| 257 | + if (atomicio6(read, conn->fd_in, p, 4, sftpio, |
| 258 | + conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL) != 4) { |
| 259 | if (errno == EPIPE || errno == ECONNRESET) |
| 260 | fatal("Connection closed"); |
| 261 | else |
| 262 | @@ -157,8 +159,8 @@ get_msg_extended(struct sftp_conn *conn, struct sshbuf *m, int initial) |
| 263 | |
| 264 | if ((r = sshbuf_reserve(m, msg_len, &p)) != 0) |
| 265 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); |
| 266 | - if (atomicio6(read, conn->fd_in, p, msg_len, |
| 267 | - conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in) |
| 268 | + if (atomicio6(read, conn->fd_in, p, msg_len, sftpio, |
| 269 | + conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL) |
| 270 | != msg_len) { |
| 271 | if (errno == EPIPE) |
| 272 | fatal("Connection closed"); |
| 273 | -- |
| 274 | 2.7.4 |
| 275 | |