From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl1-x62b.google.com (mail-pl1-x62b.google.com [IPv6:2607:f8b0:4864:20::62b]) by sourceware.org (Postfix) with ESMTPS id 4ADC9385840F for ; Mon, 22 Apr 2024 13:14:02 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 4ADC9385840F Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=linaro.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 4ADC9385840F Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::62b ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1713791644; cv=none; b=spwJT164SeNuklr1Bjv6fBIoFq2aC1zOhTijeAdvKaUMAn1B9AfeK9FDZusISc/eaYg7dLvLnsOM484Es2eBV6n7nj518TrAfZ6BF/A3xklxLrw2AwQwYiGFukWDAGs1dLTfGEfmwpS5Pm/YmCgIn99JpFGqy8KTjobVpEeBDRg= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1713791644; c=relaxed/simple; bh=nw7yI7Mu5q8rOqagoxQK9PorTxqISZuyYoBlENWxfSE=; h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From; b=HtejSDKVdEBh//x2ATRXsLSUdZRPj7kTAvg737t+2MX+kbtGLDfxNuHEliQue2V4/sByVbTW/AGSYCUIobB722JowwCmjd326BxdIhCad3jnB3J7gYGaXP8xQNmwVkzhj2htajTHix/u4cfiH8yyOHJaGndMsY2FQuU+rul1+eM= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pl1-x62b.google.com with SMTP id d9443c01a7336-1e455b630acso23927195ad.1 for ; Mon, 22 Apr 2024 06:14:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1713791641; x=1714396441; darn=sourceware.org; h=content-transfer-encoding:in-reply-to:organization:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to; bh=pmVt9SgvNEgH9eoTZNdhOe/9/Odgze+B6+VwHtMTc2k=; b=Ii6WbLbacKroLlQJawiMqtBNtDsh5l0FLw5puaSD+8QrFQ3hAOYscMCr0KrdOfatW4 1p1F4xrn960s2WcKUUpjdzHaiJVbrBd4SUCqbeKz+wc5TAmIAH5LbhL9vIAd2Xy/6qRs JxkTKrgzti0GH7Go+S1PVjj4xboW7ewDvpVC2SbkYqVcooRL8/ieVwbfDRZCNQGtId6K JJ5Jofu6oPZq0VnzCXUBseaIWRPNBuu3zPk8MeFnRbaZg+AeknEAELqubE4nxRj0F7qM 15F6oBBfjWFjLH6YtsfMO2QCC8Qaosi8UQfR5+gGs0gD5IfVf7RA3DyppsV2n9q0O+y1 BFzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713791641; x=1714396441; h=content-transfer-encoding:in-reply-to:organization:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=pmVt9SgvNEgH9eoTZNdhOe/9/Odgze+B6+VwHtMTc2k=; b=RXhiEGpiTitj0GVfttFumirT7hkwpyrwItnH7ZyovMejFr5C5ENQAsVQbiU4EAufdO Dm1IONJI/r2c+eS/cyqPFE80i1TWZ0pRlC5UH0VeNI19txW8e6PsBs5n9tsRw/nDrWIC IJUL+kRjsfmkCoqrNBR7OH0PojO27iSe6XceocQnGd5s3/HGoOUuGWfSwFkJIUYf8vmX wYwHrz6mRgXSQWSuep14A/8t6/amKEzJjHqZlkhEKcITlHs0zx5qwu1uwHu/r+jLJNzW w26kHtz6oo8+cCBwEjwblH13gT4Nc3hDarPK1RU2yXUqhHiVw/FywLYgnwTxnUPA1xGM VYtQ== X-Forwarded-Encrypted: i=1; AJvYcCV+xoyjHcjT1SGf1QWQ9z82ByrAC+/PqGcUf3K1+0T7SRbgMY/2vN1pHCuq/jC3KwbggalC58c3g08ovbNfacWAUIjES/U2Zpt4jA== X-Gm-Message-State: AOJu0YxXBGekmdbPB7zPnZE0wHM+v++Vu6fx3jcksXgbYkXq08iZml9R Zu2a3TawQ0EQrQAFCmmvVnPwd7W7syHkESXD4Ms1TLRqkfxUW1jzEu0Xq5s/igk= X-Google-Smtp-Source: AGHT+IHSUbWl+UZnIu5V6rLloeVb0lLhekmqaV4NHeg0A88n7QWYa243B0A10omGL5TDc11/u/nNXA== X-Received: by 2002:a17:903:120e:b0:1e6:6bba:7c70 with SMTP id l14-20020a170903120e00b001e66bba7c70mr10168756plh.36.1713791640896; Mon, 22 Apr 2024 06:14:00 -0700 (PDT) Received: from ?IPV6:2804:1b3:a7c1:6157:ec04:29f5:f994:4bca? ([2804:1b3:a7c1:6157:ec04:29f5:f994:4bca]) by smtp.gmail.com with ESMTPSA id bf6-20020a170902b90600b001e86e5dcb81sm8032327plb.283.2024.04.22.06.13.59 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 22 Apr 2024 06:14:00 -0700 (PDT) Message-ID: Date: Mon, 22 Apr 2024 10:13:57 -0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [COMMITTED 2.31] iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961) To: Aurelien Jarno , libc-stable@sourceware.org Cc: Carlos O'Donell References: <20240419195247.1794363-1-aurelien@aurel32.net> Content-Language: en-US From: Adhemerval Zanella Netto Organization: Linaro In-Reply-To: <20240419195247.1794363-1-aurelien@aurel32.net> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-12.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,KAM_SHORT,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: I think we also need to update the advisories/GLIBC-SA-2024-0004 with this backport. On 19/04/24 16:52, Aurelien Jarno wrote: > From: Charles Fol > > ISO-2022-CN-EXT uses escape sequences to indicate character set changes > (as specified by RFC 1922). While the SOdesignation has the expected > bounds checks, neither SS2designation nor SS3designation have its; > allowing a write overflow of 1, 2, or 3 bytes with fixed values: > '$+I', '$+J', '$+K', '$+L', '$+M', or '$*H'. > > Checked on aarch64-linux-gnu. > > Co-authored-by: Adhemerval Zanella > Reviewed-by: Carlos O'Donell > Tested-by: Carlos O'Donell > > (cherry picked from commit f9dc609e06b1136bb0408be9605ce7973a767ada) > --- > iconvdata/Makefile | 5 +- > iconvdata/iso-2022-cn-ext.c | 12 +++ > iconvdata/tst-iconv-iso-2022-cn-ext.c | 128 ++++++++++++++++++++++++++ > 3 files changed, 144 insertions(+), 1 deletion(-) > create mode 100644 iconvdata/tst-iconv-iso-2022-cn-ext.c > > diff --git a/iconvdata/Makefile b/iconvdata/Makefile > index 8fbb67a52b..31b1cf8a9f 100644 > --- a/iconvdata/Makefile > +++ b/iconvdata/Makefile > @@ -75,7 +75,8 @@ ifeq (yes,$(build-shared)) > tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \ > tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \ > bug-iconv10 bug-iconv11 bug-iconv12 bug-iconv13 bug-iconv14 \ > - bug-iconv15 > + bug-iconv15 \ > + tst-iconv-iso-2022-cn-ext > ifeq ($(have-thread-library),yes) > tests += bug-iconv3 > endif > @@ -322,6 +323,8 @@ $(objpfx)bug-iconv14.out: $(objpfx)gconv-modules \ > $(addprefix $(objpfx),$(modules.so)) > $(objpfx)bug-iconv15.out: $(addprefix $(objpfx), $(gconv-modules)) \ > $(addprefix $(objpfx),$(modules.so)) > +$(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules)) \ > + $(addprefix $(objpfx),$(modules.so)) > > $(objpfx)iconv-test.out: run-iconv-test.sh $(objpfx)gconv-modules \ > $(addprefix $(objpfx),$(modules.so)) \ > diff --git a/iconvdata/iso-2022-cn-ext.c b/iconvdata/iso-2022-cn-ext.c > index 947b807421..34e1010bed 100644 > --- a/iconvdata/iso-2022-cn-ext.c > +++ b/iconvdata/iso-2022-cn-ext.c > @@ -575,6 +575,12 @@ DIAG_IGNORE_Os_NEEDS_COMMENT (5, "-Wmaybe-uninitialized"); > { \ > const char *escseq; \ > \ > + if (outptr + 4 > outend) \ > + { \ > + result = __GCONV_FULL_OUTPUT; \ > + break; \ > + } \ > + \ > assert (used == CNS11643_2_set); /* XXX */ \ > escseq = "*H"; \ > *outptr++ = ESC; \ > @@ -588,6 +594,12 @@ DIAG_IGNORE_Os_NEEDS_COMMENT (5, "-Wmaybe-uninitialized"); > { \ > const char *escseq; \ > \ > + if (outptr + 4 > outend) \ > + { \ > + result = __GCONV_FULL_OUTPUT; \ > + break; \ > + } \ > + \ > assert ((used >> 5) >= 3 && (used >> 5) <= 7); \ > escseq = "+I+J+K+L+M" + ((used >> 5) - 3) * 2; \ > *outptr++ = ESC; \ > diff --git a/iconvdata/tst-iconv-iso-2022-cn-ext.c b/iconvdata/tst-iconv-iso-2022-cn-ext.c > new file mode 100644 > index 0000000000..96a8765fd5 > --- /dev/null > +++ b/iconvdata/tst-iconv-iso-2022-cn-ext.c > @@ -0,0 +1,128 @@ > +/* Verify ISO-2022-CN-EXT does not write out of the bounds. > + Copyright (C) 2024 Free Software Foundation, Inc. > + This file is part of the GNU C Library. > + > + The GNU C Library is free software; you can redistribute it and/or > + modify it under the terms of the GNU Lesser General Public > + License as published by the Free Software Foundation; either > + version 2.1 of the License, or (at your option) any later version. > + > + The GNU C Library is distributed in the hope that it will be useful, > + but WITHOUT ANY WARRANTY; without even the implied warranty of > + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU > + Lesser General Public License for more details. > + > + You should have received a copy of the GNU Lesser General Public > + License along with the GNU C Library; if not, see > + . */ > + > +#include > +#include > + > +#include > +#include > +#include > + > +#include > +#include > +#include > + > +/* The test sets up a two memory page buffer with the second page marked > + PROT_NONE to trigger a fault if the conversion writes beyond the exact > + expected amount. Then we carry out various conversions and precisely > + place the start of the output buffer in order to trigger a SIGSEGV if the > + process writes anywhere between 1 and page sized bytes more (only one > + PROT_NONE page is setup as a canary) than expected. These tests exercise > + all three of the cases in ISO-2022-CN-EXT where the converter must switch > + character sets and may run out of buffer space while doing the > + operation. */ > + > +static int > +do_test (void) > +{ > + iconv_t cd = iconv_open ("ISO-2022-CN-EXT", "UTF-8"); > + TEST_VERIFY_EXIT (cd != (iconv_t) -1); > + > + char *ntf; > + size_t ntfsize; > + char *outbufbase; > + { > + int pgz = getpagesize (); > + TEST_VERIFY_EXIT (pgz > 0); > + ntfsize = 2 * pgz; > + > + ntf = xmmap (NULL, ntfsize, PROT_READ | PROT_WRITE, MAP_PRIVATE > + | MAP_ANONYMOUS, -1); > + xmprotect (ntf + pgz, pgz, PROT_NONE); > + > + outbufbase = ntf + pgz; > + } > + > + /* Check if SOdesignation escape sequence does not trigger an OOB write. */ > + { > + char inbuf[] = "\xe4\xba\xa4\xe6\x8d\xa2"; > + > + for (int i = 0; i < 9; i++) > + { > + char *inp = inbuf; > + size_t inleft = sizeof (inbuf) - 1; > + > + char *outp = outbufbase - i; > + size_t outleft = i; > + > + TEST_VERIFY_EXIT (iconv (cd, &inp, &inleft, &outp, &outleft) > + == (size_t) -1); > + TEST_COMPARE (errno, E2BIG); > + > + TEST_VERIFY_EXIT (iconv (cd, NULL, NULL, NULL, NULL) == 0); > + } > + } > + > + /* Same as before for SS2designation. */ > + { > + char inbuf[] = "㴽 \xe3\xb4\xbd"; > + > + for (int i = 0; i < 14; i++) > + { > + char *inp = inbuf; > + size_t inleft = sizeof (inbuf) - 1; > + > + char *outp = outbufbase - i; > + size_t outleft = i; > + > + TEST_VERIFY_EXIT (iconv (cd, &inp, &inleft, &outp, &outleft) > + == (size_t) -1); > + TEST_COMPARE (errno, E2BIG); > + > + TEST_VERIFY_EXIT (iconv (cd, NULL, NULL, NULL, NULL) == 0); > + } > + } > + > + /* Same as before for SS3designation. */ > + { > + char inbuf[] = "劄 \xe5\x8a\x84"; > + > + for (int i = 0; i < 14; i++) > + { > + char *inp = inbuf; > + size_t inleft = sizeof (inbuf) - 1; > + > + char *outp = outbufbase - i; > + size_t outleft = i; > + > + TEST_VERIFY_EXIT (iconv (cd, &inp, &inleft, &outp, &outleft) > + == (size_t) -1); > + TEST_COMPARE (errno, E2BIG); > + > + TEST_VERIFY_EXIT (iconv (cd, NULL, NULL, NULL, NULL) == 0); > + } > + } > + > + TEST_VERIFY_EXIT (iconv_close (cd) != -1); > + > + xmunmap (ntf, ntfsize); > + > + return 0; > +} > + > +#include