--- /dev/null
+From a96c0528c68093d155b674269a9c8bf48315fc01 Mon Sep 17 00:00:00 2001
+From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
+Date: Tue, 24 Nov 2015 13:47:16 +1300
+Subject: [PATCH 1/3] CVE-2015-5330: Fix handling of unicode near string
+ endings
+
+Until now next_codepoint_ext() and next_codepoint_handle_ext() were
+using strnlen(str, 5) to determine how much string they should try to
+decode. This ended up looking past the end of the string when it was not
+null terminated and the final character looked like a multi-byte encoding.
+The fix is to let the caller say how long the string can be.
+
+Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599
+
+Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
+Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
+Reviewed-by: Ralph Boehme <slow@samba.org>
+---
+ lib/util/charset/charset.h | 9 +++++----
+ lib/util/charset/codepoints.c | 19 +++++++++++++------
+ lib/util/charset/util_unistr.c | 5 ++++-
+ source3/lib/util_str.c | 2 +-
+ 4 files changed, 23 insertions(+), 12 deletions(-)
+
+diff --git a/lib/util/charset/charset.h b/lib/util/charset/charset.h
+index 474d77e..b70aa61 100644
+--- a/lib/util/charset/charset.h
++++ b/lib/util/charset/charset.h
+@@ -175,15 +175,16 @@ smb_iconv_t get_conv_handle(struct smb_iconv_convenience *ic,
+ charset_t from, charset_t to);
+ const char *charset_name(struct smb_iconv_convenience *ic, charset_t ch);
+
+-codepoint_t next_codepoint_ext(const char *str, charset_t src_charset,
+- size_t *size);
++codepoint_t next_codepoint_ext(const char *str, size_t len,
++ charset_t src_charset, size_t *size);
+ codepoint_t next_codepoint(const char *str, size_t *size);
+ ssize_t push_codepoint(char *str, codepoint_t c);
+
+ /* codepoints */
+ codepoint_t next_codepoint_convenience_ext(struct smb_iconv_convenience *ic,
+- const char *str, charset_t src_charset,
+- size_t *size);
++ const char *str, size_t len,
++ charset_t src_charset,
++ size_t *size);
+ codepoint_t next_codepoint_convenience(struct smb_iconv_convenience *ic,
+ const char *str, size_t *size);
+ ssize_t push_codepoint_convenience(struct smb_iconv_convenience *ic,
+diff --git a/lib/util/charset/codepoints.c b/lib/util/charset/codepoints.c
+index 5ee95a8..8dd647e 100644
+--- a/lib/util/charset/codepoints.c
++++ b/lib/util/charset/codepoints.c
+@@ -346,7 +346,8 @@ smb_iconv_t get_conv_handle(struct smb_iconv_convenience *ic,
+ */
+ _PUBLIC_ codepoint_t next_codepoint_convenience_ext(
+ struct smb_iconv_convenience *ic,
+- const char *str, charset_t src_charset,
++ const char *str, size_t len,
++ charset_t src_charset,
+ size_t *bytes_consumed)
+ {
+ /* it cannot occupy more than 4 bytes in UTF16 format */
+@@ -366,7 +367,7 @@ _PUBLIC_ codepoint_t next_codepoint_convenience_ext(
+ * we assume that no multi-byte character can take more than 5 bytes.
+ * This is OK as we only support codepoints up to 1M (U+100000)
+ */
+- ilen_orig = strnlen(str, 5);
++ ilen_orig = MIN(len, 5);
+ ilen = ilen_orig;
+
+ descriptor = get_conv_handle(ic, src_charset, CH_UTF16);
+@@ -424,7 +425,13 @@ _PUBLIC_ codepoint_t next_codepoint_convenience_ext(
+ _PUBLIC_ codepoint_t next_codepoint_convenience(struct smb_iconv_convenience *ic,
+ const char *str, size_t *size)
+ {
+- return next_codepoint_convenience_ext(ic, str, CH_UNIX, size);
++ /*
++ * We assume that no multi-byte character can take more than 5 bytes
++ * thus avoiding walking all the way down a long string. This is OK as
++ * Unicode codepoints only go up to (U+10ffff), which can always be
++ * encoded in 4 bytes or less.
++ */
++ return next_codepoint_convenience_ext(ic, str, strnlen(str, 5), CH_UNIX, size);
+ }
+
+ /*
+@@ -486,10 +493,10 @@ _PUBLIC_ ssize_t push_codepoint_convenience(struct smb_iconv_convenience *ic,
+ return 5 - olen;
+ }
+
+-_PUBLIC_ codepoint_t next_codepoint_ext(const char *str, charset_t src_charset,
+- size_t *size)
++_PUBLIC_ codepoint_t next_codepoint_ext(const char *str, size_t len,
++ charset_t src_charset, size_t *size)
+ {
+- return next_codepoint_convenience_ext(get_iconv_convenience(), str,
++ return next_codepoint_convenience_ext(get_iconv_convenience(), str, len,
+ src_charset, size);
+ }
+
+diff --git a/lib/util/charset/util_unistr.c b/lib/util/charset/util_unistr.c
+index 760be77..d9e9b34 100644
+--- a/lib/util/charset/util_unistr.c
++++ b/lib/util/charset/util_unistr.c
+@@ -485,7 +485,10 @@ _PUBLIC_ char *strupper_talloc_n(TALLOC_CTX *ctx, const char *src, size_t n)
+
+ while (n-- && *src) {
+ size_t c_size;
+- codepoint_t c = next_codepoint_convenience(iconv_convenience, src, &c_size);
++ codepoint_t c = next_codepoint_convenience_ext(iconv_convenience,
++ src,
++ n,
++ &c_size);
+ src += c_size;
+
+ c = toupper_m(c);
+diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c
+index 4701528..f8a5160 100644
+--- a/source3/lib/util_str.c
++++ b/source3/lib/util_str.c
+@@ -1486,7 +1486,7 @@ size_t strlen_m_ext(const char *s, const charset_t src_charset,
+
+ while (*s) {
+ size_t c_size;
+- codepoint_t c = next_codepoint_ext(s, src_charset, &c_size);
++ codepoint_t c = next_codepoint_ext(s, strnlen(s, 5), src_charset, &c_size);
+ s += c_size;
+
+ switch (dst_charset) {
+--
+2.5.0
+
+
+From 8298252a1ba9c014f7ceb76736abb38132181f79 Mon Sep 17 00:00:00 2001
+From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
+Date: Tue, 24 Nov 2015 13:54:09 +1300
+Subject: [PATCH 2/3] CVE-2015-5330: next_codepoint_handle_ext: don't
+ short-circuit UTF16 low bytes
+
+UTF16 contains zero bytes when it is encoding ASCII (for example), so we
+can't assume the absense of the 0x80 bit means a one byte encoding. No
+current callers use UTF16.
+
+Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599
+
+Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
+Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
+Reviewed-by: Ralph Boehme <slow@samba.org>
+---
+ lib/util/charset/codepoints.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/lib/util/charset/codepoints.c b/lib/util/charset/codepoints.c
+index 8dd647e..cf5f3e6 100644
+--- a/lib/util/charset/codepoints.c
++++ b/lib/util/charset/codepoints.c
+@@ -358,7 +358,10 @@ _PUBLIC_ codepoint_t next_codepoint_convenience_ext(
+ size_t olen;
+ char *outbuf;
+
+- if ((str[0] & 0x80) == 0) {
++
++ if (((str[0] & 0x80) == 0) && (src_charset == CH_DOS ||
++ src_charset == CH_UNIX ||
++ src_charset == CH_UTF8)) {
+ *bytes_consumed = 1;
+ return (codepoint_t)str[0];
+ }
+--
+2.5.0
+
+
+From 0988b7cb606a7e4cd73fd8db02806abbc9d8f2e0 Mon Sep 17 00:00:00 2001
+From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
+Date: Tue, 24 Nov 2015 13:49:09 +1300
+Subject: [PATCH 3/3] CVE-2015-5330: strupper_talloc_n_handle(): properly count
+ characters
+
+When a codepoint eats more than one byte we really want to know,
+especially if the string is not NUL terminated.
+
+Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599
+
+Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
+Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
+Reviewed-by: Ralph Boehme <slow@samba.org>
+---
+ lib/util/charset/util_unistr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/util/charset/util_unistr.c b/lib/util/charset/util_unistr.c
+index d9e9b34..6dad43f 100644
+--- a/lib/util/charset/util_unistr.c
++++ b/lib/util/charset/util_unistr.c
+@@ -483,13 +483,14 @@ _PUBLIC_ char *strupper_talloc_n(TALLOC_CTX *ctx, const char *src, size_t n)
+ return NULL;
+ }
+
+- while (n-- && *src) {
++ while (n && *src) {
+ size_t c_size;
+ codepoint_t c = next_codepoint_convenience_ext(iconv_convenience,
+ src,
+ n,
+ &c_size);
+ src += c_size;
++ n -= c_size;
+
+ c = toupper_m(c);
+
+--
+2.5.0
+
projects / ipfire-2.x.git / blobdiff