CVE-2014-6040: Crashes on invalid input in IBM gconv modules [BZ #17325]

These changes are based on the fix for BZ #14134 in commit
6e230d11837f3ae7b375ea69d7905f0d18eb79e5.

diff --git a/ChangeLog b/ChangeLog
index f97a907ed404768ad21b17a2c1ada241a6445ed3..498e493659a6b126a6bcce9ecd454ae3fcbb0ce2 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,20 @@
+2014-09-03  Florian Weimer  <fweimer@redhat.com>
+
+       [BZ #17325]
+       * iconvdata/ibm1364.c (BODY): Fix check for sentinel.
+       * iconvdata/ibm932.c (BODY): Replace invalid sentinel check with
+       assert.
+       * iconvdata/ibm933.c (BODY): Fix check for sentinel.
+       * iconvdata/ibm935.c (BODY): Likewise.
+       * iconvdata/ibm937.c (BODY): Likewise.
+       * iconvdata/ibm939.c (BODY): Likewise.
+       * iconvdata/ibm943.c (BODY): Replace invalid sentinel check with
+       assert.
+       * iconvdata/Makefile (iconv-test.out): Pass module list to test
+       script.
+       * iconvdata/run-iconv-test.sh: New test loop for checking for
+       decoder crashers.
+
 2014-09-02  Khem Raj  <raj.khem@gmail.com>
 
        * sysdeps/powerpc/powerpc32/e500/nofpu/fegetenv.c (fegetenv): Add

diff --git a/NEWS b/NEWS
index 1af9e706dccb22d5806c0456468ece9e28a34a81..17b75825fa517ed428e92a898fe9fa4ba20b358d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -23,7 +23,7 @@ Version 2.20
   16966, 16967, 16977, 16978, 16984, 16990, 16996, 17009, 17022, 17031,
   17042, 17048, 17050, 17058, 17061, 17062, 17069, 17075, 17078, 17079,
   17084, 17086, 17088, 17092, 17097, 17125, 17135, 17137, 17150, 17153,
-  17187, 17213, 17259, 17261, 17262, 17263, 17319.
+  17187, 17213, 17259, 17261, 17262, 17263, 17319, 17325.
 
 * Reverted change of ABI data structures for s390 and s390x:
   On s390 and s390x the size of struct ucontext and jmp_buf was increased in
@@ -115,6 +115,11 @@ Version 2.20
   normal gconv conversion modules are still supported.  Transliteration
   with //TRANSLIT is still possible, and the //IGNORE specifier
   continues to be  supported. (CVE-2014-5119)
+
+* Decoding a crafted input sequence in the character sets IBM933, IBM935,
+  IBM937, IBM939, IBM1364 could result in an out-of-bounds array read,
+  resulting a denial-of-service security vulnerability in applications which
+  use functions related to iconv. (CVE-2014-6040)
 \f
 Version 2.19
 

diff --git a/iconvdata/Makefile b/iconvdata/Makefile
index 0a410a1bc8cf561357fded082a8ce91676867985..b6327d60263055cf2343340c398473be8f412041 100644 (file)
--- a/iconvdata/Makefile
+++ b/iconvdata/Makefile
@@ -297,6 +297,7 @@ $(objpfx)tst-iconv7.out: $(objpfx)gconv-modules \
 $(objpfx)iconv-test.out: run-iconv-test.sh $(objpfx)gconv-modules \
                         $(addprefix $(objpfx),$(modules.so)) \
                         $(common-objdir)/iconv/iconv_prog TESTS
+       iconv_modules="$(modules)" \
        $(SHELL) $< $(common-objdir) '$(test-wrapper-env)' \
                 '$(run-program-env)' > $@; \
        $(evaluate-test)

diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c
index 0b5484fc20e95d19e4a3aef4d7616e29e3ec3269..cf8099351d0705116b49e3caafac5aaef3bc22bd 100644 (file)
--- a/iconvdata/ibm1364.c
+++ b/iconvdata/ibm1364.c
@@ -221,7 +221,8 @@ enum
          ++rp2;                                                              \
                                                                              \
        uint32_t res;                                                         \
-       if (__builtin_expect (ch < rp2->start, 0)                             \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
+           || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = DB_TO_UCS4[ch + rp2->idx],                              \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \
          {                                                                   \

diff --git a/iconvdata/ibm932.c b/iconvdata/ibm932.c
index f5dca59ac77e7d3cfe0b21e9b00e569ac101d3c9..aa69d651a73cfc6294ab9699630590b07073374d 100644 (file)
--- a/iconvdata/ibm932.c
+++ b/iconvdata/ibm932.c
@@ -74,11 +74,12 @@
          }                                                                   \
                                                                              \
        ch = (ch * 0x100) + inptr[1];                                         \
+       /* ch was less than 0xfd.  */                                         \
+       assert (ch < 0xfd00);                                                 \
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
-           || __builtin_expect (ch < rp2->start, 0)                          \
+       if (__builtin_expect (ch < rp2->start, 0)                             \
            || (res = __ibm932db_to_ucs4[ch + rp2->idx],                      \
            __builtin_expect (res, '\1') == 0 && ch !=0))                     \
          {                                                                   \

diff --git a/iconvdata/ibm933.c b/iconvdata/ibm933.c
index f46dfb51fe18d01a86b526b020783939d05c2ea8..461fb5e70ca0b70918231d59f8bcf95cbbacdc0d 100644 (file)
--- a/iconvdata/ibm933.c
+++ b/iconvdata/ibm933.c
@@ -162,7 +162,7 @@ enum
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
            || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = __ibm933db_to_ucs4[ch + rp2->idx],                      \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \

diff --git a/iconvdata/ibm935.c b/iconvdata/ibm935.c
index a8e4e6cfb9741846a554a33fe336c4ffce163c17..132d81648a08efa94d1605750278a0b7bc71f0a0 100644 (file)
--- a/iconvdata/ibm935.c
+++ b/iconvdata/ibm935.c
@@ -162,7 +162,7 @@ enum
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
            || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = __ibm935db_to_ucs4[ch + rp2->idx],                      \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \

diff --git a/iconvdata/ibm937.c b/iconvdata/ibm937.c
index 239be613e94c74e5bee08b397f1ce8ff64781ca5..69b154d1aeedef3b061647ea0e4b3b5f6c7f9cfb 100644 (file)
--- a/iconvdata/ibm937.c
+++ b/iconvdata/ibm937.c
@@ -162,7 +162,7 @@ enum
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
            || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = __ibm937db_to_ucs4[ch + rp2->idx],                      \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \

diff --git a/iconvdata/ibm939.c b/iconvdata/ibm939.c
index 5d0db3686bc8a41f965a818fc07b710509421fe2..9936e2c1766295c120c9db69d3357b29d936bd63 100644 (file)
--- a/iconvdata/ibm939.c
+++ b/iconvdata/ibm939.c
@@ -162,7 +162,7 @@ enum
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
            || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = __ibm939db_to_ucs4[ch + rp2->idx],                      \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \

diff --git a/iconvdata/ibm943.c b/iconvdata/ibm943.c
index be0c14f681d11f07b663cd62a5d633e097bc8f9e..c5d57421365d077284d6bc9ba42870642796dc9e 100644 (file)
--- a/iconvdata/ibm943.c
+++ b/iconvdata/ibm943.c
@@ -75,11 +75,12 @@
          }                                                                   \
                                                                              \
        ch = (ch * 0x100) + inptr[1];                                         \
+       /* ch was less than 0xfd.  */                                         \
+       assert (ch < 0xfd00);                                                 \
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
-           || __builtin_expect (ch < rp2->start, 0)                          \
+       if (__builtin_expect (ch < rp2->start, 0)                             \
            || (res = __ibm943db_to_ucs4[ch + rp2->idx],                      \
            __builtin_expect (res, '\1') == 0 && ch !=0))                     \
          {                                                                   \

diff --git a/iconvdata/run-iconv-test.sh b/iconvdata/run-iconv-test.sh
index c98c92950d79710bdfccc189bfdb7728239a285b..5dfb69fe3a724ea2415201179274822b79e90d9e 100755 (executable)
--- a/iconvdata/run-iconv-test.sh
+++ b/iconvdata/run-iconv-test.sh
@@ -184,6 +184,24 @@ while read utf8 from filename; do
 
 done < TESTS2
 
+# Check for crashes in decoders.
+printf '\016\377\377\377\377\377\377\377' > $temp1
+for from in $iconv_modules ; do
+    echo $ac_n "test decoder $from $ac_c"
+    PROG=`eval echo $ICONV`
+    if $PROG < $temp1 >/dev/null 2>&1 ; then
+       : # fall through
+    else
+       status=$?
+       if test $status -gt 1 ; then
+           echo "/FAILED"
+           failed=1
+           continue
+       fi
+    fi
+    echo "OK"
+done
+
 exit $failed
 # Local Variables:
 #  mode:shell-script