CVE-2014-6040: Crashes on invalid input in IBM gconv modules [BZ #17325]

These changes are based on the fix for BZ #14134 in commit
6e230d11837f3ae7b375ea69d7905f0d18eb79e5.

diff --git a/ChangeLog b/ChangeLog
index 14760a24ee26daea98c89c162194ee4339a98a28..ccdfddf8acc243de1f6999e76c323e154da3335c 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,20 @@
+2014-09-03  Florian Weimer  <fweimer@redhat.com>
+
+       [BZ #17325]
+       * iconvdata/ibm1364.c (BODY): Fix check for sentinel.
+       * iconvdata/ibm932.c (BODY): Replace invalid sentinel check with
+       assert.
+       * iconvdata/ibm933.c (BODY): Fix check for sentinel.
+       * iconvdata/ibm935.c (BODY): Likewise.
+       * iconvdata/ibm937.c (BODY): Likewise.
+       * iconvdata/ibm939.c (BODY): Likewise.
+       * iconvdata/ibm943.c (BODY): Replace invalid sentinel check with
+       assert.
+       * iconvdata/Makefile (iconv-test.out): Pass module list to test
+       script.
+       * iconvdata/run-iconv-test.sh: New test loop for checking for
+       decoder crashers.
+
 2014-02-18  Brooks Moses  <bmoses@google.com>
 
        [BZ #15915]

diff --git a/NEWS b/NEWS
index e2931f13c4c0bc8684d2d8a21dad7063131a6d1e..8029dab04adea2729c814f8b795cde94b54af2b3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -11,10 +11,15 @@ Version 2.18.1
 
   14143, 14155, 14547, 14699, 15532, 15427, 15522, 15680, 15723, 15734,
   15735, 15797, 15892, 15895, 15909, 15915, 15917, 15996, 16072, 16150,
-  16414, 16430, 16431.
+  16414, 16430, 16431, 17325.
 
 * Support for powerpc64le has been added.
 
+* Decoding a crafted input sequence in the character sets IBM933, IBM935,
+  IBM937, IBM939, IBM1364 could result in an out-of-bounds array read,
+  resulting a denial-of-service security vulnerability in applications which
+  use functions related to iconv. (CVE-2014-6040)
+
 * CVE-2013-4237 The readdir_r function could write more than NAME_MAX bytes
   to the d_name member of struct dirent, or omit the terminating NUL
   character.  (Bugzilla #14699).

diff --git a/iconvdata/Makefile b/iconvdata/Makefile
index 7752013f5ba215afb60e182d82698153d1a62b6a..a8c43bd557c1226ff03f565d28430576d2ccdc74 100644 (file)
--- a/iconvdata/Makefile
+++ b/iconvdata/Makefile
@@ -299,7 +299,10 @@ $(objpfx)tst-iconv7.out: $(objpfx)gconv-modules \
 $(objpfx)iconv-test.out: run-iconv-test.sh $(objpfx)gconv-modules \
                         $(addprefix $(objpfx),$(modules.so)) \
                         $(common-objdir)/iconv/iconv_prog TESTS
-       $(SHELL) $< $(common-objdir) '$(test-wrapper)' > $@
+       iconv_modules="$(modules)" \
+       $(SHELL) $< $(common-objdir) '$(test-wrapper-env)' \
+                '$(run-program-env)' > $@; \
+       $(evaluate-test)
 
 $(objpfx)tst-tables.out: tst-tables.sh $(objpfx)gconv-modules \
                         $(addprefix $(objpfx),$(modules.so)) \

diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c
index 0dfa250692bbbe5f97a745ce5dc964aa3bbbabcd..569fdc185c95788dd06ec9f0e865b1f7836b54e6 100644 (file)
--- a/iconvdata/ibm1364.c
+++ b/iconvdata/ibm1364.c
@@ -220,7 +220,8 @@ enum
          ++rp2;                                                              \
                                                                              \
        uint32_t res;                                                         \
-       if (__builtin_expect (ch < rp2->start, 0)                             \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
+           || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = DB_TO_UCS4[ch + rp2->idx],                              \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \
          {                                                                   \

diff --git a/iconvdata/ibm932.c b/iconvdata/ibm932.c
index 0764fb238581b044a2dd23c0ddf80530acfbab69..cbdaad32d187a9e119b0e12ea84199b9475dc53f 100644 (file)
--- a/iconvdata/ibm932.c
+++ b/iconvdata/ibm932.c
@@ -73,11 +73,12 @@
          }                                                                   \
                                                                              \
        ch = (ch * 0x100) + inptr[1];                                         \
+       /* ch was less than 0xfd.  */                                         \
+       assert (ch < 0xfd00);                                                 \
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
-           || __builtin_expect (ch < rp2->start, 0)                          \
+       if (__builtin_expect (ch < rp2->start, 0)                             \
            || (res = __ibm932db_to_ucs4[ch + rp2->idx],                      \
            __builtin_expect (res, '\1') == 0 && ch !=0))                     \
          {                                                                   \

diff --git a/iconvdata/ibm933.c b/iconvdata/ibm933.c
index 145d12f98a6d8f965bbab3b9d6903cf19387978b..b56a68dd9b03fed717882c2c6b2509b497cafe50 100644 (file)
--- a/iconvdata/ibm933.c
+++ b/iconvdata/ibm933.c
@@ -161,7 +161,7 @@ enum
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
            || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = __ibm933db_to_ucs4[ch + rp2->idx],                      \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \

diff --git a/iconvdata/ibm935.c b/iconvdata/ibm935.c
index 7d5628bb7e39f9c1c880cb504bb5bf5ee3f1f682..4d111b0a8d367df09cf90ad7514a5b6132479c32 100644 (file)
--- a/iconvdata/ibm935.c
+++ b/iconvdata/ibm935.c
@@ -161,7 +161,7 @@ enum
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
            || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = __ibm935db_to_ucs4[ch + rp2->idx],                      \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \

diff --git a/iconvdata/ibm937.c b/iconvdata/ibm937.c
index b913cbbb0ff789e2483b8eaf5f1534e628e087fa..dcedcd4f26725cc5816bea6d387d660a3914b5c9 100644 (file)
--- a/iconvdata/ibm937.c
+++ b/iconvdata/ibm937.c
@@ -161,7 +161,7 @@ enum
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
            || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = __ibm937db_to_ucs4[ch + rp2->idx],                      \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \

diff --git a/iconvdata/ibm939.c b/iconvdata/ibm939.c
index d42b98c4ba0527d45638b1f544771939a526c006..4727288a0488226d518b284afed31b4682eb43e1 100644 (file)
--- a/iconvdata/ibm939.c
+++ b/iconvdata/ibm939.c
@@ -161,7 +161,7 @@ enum
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
            || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = __ibm939db_to_ucs4[ch + rp2->idx],                      \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \

diff --git a/iconvdata/ibm943.c b/iconvdata/ibm943.c
index b3a655591f7ee1e8d9c26b264530dc02ba6df14c..53eb2fca168648e77967a89d452c596728ed5d53 100644 (file)
--- a/iconvdata/ibm943.c
+++ b/iconvdata/ibm943.c
@@ -74,11 +74,12 @@
          }                                                                   \
                                                                              \
        ch = (ch * 0x100) + inptr[1];                                         \
+       /* ch was less than 0xfd.  */                                         \
+       assert (ch < 0xfd00);                                                 \
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
-           || __builtin_expect (ch < rp2->start, 0)                          \
+       if (__builtin_expect (ch < rp2->start, 0)                             \
            || (res = __ibm943db_to_ucs4[ch + rp2->idx],                      \
            __builtin_expect (res, '\1') == 0 && ch !=0))                     \
          {                                                                   \

diff --git a/iconvdata/run-iconv-test.sh b/iconvdata/run-iconv-test.sh
index 107ded0dfdaa01f7b4232c4dec452d786505c884..8afece987bfb3d49eb89fd21c4e510a84fd077d3 100755 (executable)
--- a/iconvdata/run-iconv-test.sh
+++ b/iconvdata/run-iconv-test.sh
@@ -188,6 +188,24 @@ while read utf8 from filename; do
 
 done < TESTS2
 
+# Check for crashes in decoders.
+printf '\016\377\377\377\377\377\377\377' > $temp1
+for from in $iconv_modules ; do
+    echo $ac_n "test decoder $from $ac_c"
+    PROG=`eval echo $ICONV`
+    if $PROG < $temp1 >/dev/null 2>&1 ; then
+       : # fall through
+    else
+       status=$?
+       if test $status -gt 1 ; then
+           echo "/FAILED"
+           failed=1
+           continue
+       fi
+    fi
+    echo "OK"
+done
+
 exit $failed
 # Local Variables:
 #  mode:shell-script