__gconv_translit_find: Disable function [BZ #17187]

This functionality has never worked correctly, and the implementation
contained a security vulnerability (CVE-2014-5119).

diff --git a/ChangeLog b/ChangeLog
index 8423dd53cd4caa0b6da22f87c5c9af524f7d5880..a1cc122ce9559de15feb8d9315945a9f07e15556 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2014-08-26  Florian Weimer  <fweimer@redhat.com>
+
+       [BZ #17187]
+       * iconv/gconv_trans.c (struct known_trans, search_tree, lock,
+       trans_compare, open_translit, __gconv_translit_find):
+       Remove module loading code.
+
 2014-09-03  Florian Weimer  <fweimer@redhat.com>
 
        [BZ #17325]

diff --git a/NEWS b/NEWS
index 022da81f2cf0ac361c05d63ad5e2d05f4c159289..3665933311b945349b4823eac07479cf7feb6dcb 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,7 +10,14 @@ Version 2.16.1
 * The following bugs are resolved with this release:
 
   6530, 14195, 14547, 14459, 14476, 14562, 14621, 14648, 14699, 14756, 14831,
-  15078, 15754, 15755, 16072, 17325.
+  15078, 15754, 15755, 16072, 17187, 17325.
+
+* Support for loadable gconv transliteration modules has been removed.
+  The support for transliteration modules has been non-functional for
+  over a decade, and the removal is prompted by security defects.  The
+  normal gconv conversion modules are still supported.  Transliteration
+  with //TRANSLIT is still possible, and the //IGNORE specifier
+  continues to be  supported. (CVE-2014-5119)
 
 * Decoding a crafted input sequence in the character sets IBM933, IBM935,
   IBM937, IBM939, IBM1364 could result in an out-of-bounds array read,

diff --git a/iconv/gconv_trans.c b/iconv/gconv_trans.c
index 64ca97d3f2a893d248716e3175f3feb66b6f1427..786c1af1d9507060f68fc3ab2d0de3d1b19e0a33 100644 (file)
--- a/iconv/gconv_trans.c
+++ b/iconv/gconv_trans.c
@@ -238,181 +238,12 @@ __gconv_transliterate (struct __gconv_step *step,
   return __GCONV_ILLEGAL_INPUT;
 }
 
-
-/* Structure to represent results of found (or not) transliteration
-   modules.  */
-struct known_trans
-{
-  /* This structure must remain the first member.  */
-  struct trans_struct info;
-
-  char *fname;
-  void *handle;
-  int open_count;
-};
-
-
-/* Tree with results of previous calls to __gconv_translit_find.  */
-static void *search_tree;
-
-/* We modify global data.   */
-__libc_lock_define_initialized (static, lock);
-
-
-/* Compare two transliteration entries.  */
-static int
-trans_compare (const void *p1, const void *p2)
-{
-  const struct known_trans *s1 = (const struct known_trans *) p1;
-  const struct known_trans *s2 = (const struct known_trans *) p2;
-
-  return strcmp (s1->info.name, s2->info.name);
-}
-
-
-/* Open (maybe reopen) the module named in the struct.  Get the function
-   and data structure pointers we need.  */
-static int
-open_translit (struct known_trans *trans)
-{
-  __gconv_trans_query_fct queryfct;
-
-  trans->handle = __libc_dlopen (trans->fname);
-  if (trans->handle == NULL)
-    /* Not available.  */
-    return 1;
-
-  /* Find the required symbol.  */
-  queryfct = __libc_dlsym (trans->handle, "gconv_trans_context");
-  if (queryfct == NULL)
-    {
-      /* We cannot live with that.  */
-    close_and_out:
-      __libc_dlclose (trans->handle);
-      trans->handle = NULL;
-      return 1;
-    }
-
-  /* Get the context.  */
-  if (queryfct (trans->info.name, &trans->info.csnames, &trans->info.ncsnames)
-      != 0)
-    goto close_and_out;
-
-  /* Of course we also have to have the actual function.  */
-  trans->info.trans_fct = __libc_dlsym (trans->handle, "gconv_trans");
-  if (trans->info.trans_fct == NULL)
-    goto close_and_out;
-
-  /* Now the optional functions.  */
-  trans->info.trans_init_fct =
-    __libc_dlsym (trans->handle, "gconv_trans_init");
-  trans->info.trans_context_fct =
-    __libc_dlsym (trans->handle, "gconv_trans_context");
-  trans->info.trans_end_fct =
-    __libc_dlsym (trans->handle, "gconv_trans_end");
-
-  trans->open_count = 1;
-
-  return 0;
-}
-
-
 int
 internal_function
 __gconv_translit_find (struct trans_struct *trans)
 {
-  struct known_trans **found;
-  const struct path_elem *runp;
-  int res = 1;
-
-  /* We have to have a name.  */
-  assert (trans->name != NULL);
-
-  /* Acquire the lock.  */
-  __libc_lock_lock (lock);
-
-  /* See whether we know this module already.  */
-  found = __tfind (trans, &search_tree, trans_compare);
-  if (found != NULL)
-    {
-      /* Is this module available?  */
-      if ((*found)->handle != NULL)
-       {
-         /* Maybe we have to reopen the file.  */
-         if ((*found)->handle != (void *) -1)
-           /* The object is not unloaded.  */
-           res = 0;
-         else if (open_translit (*found) == 0)
-           {
-             /* Copy the data.  */
-             *trans = (*found)->info;
-             (*found)->open_count++;
-             res = 0;
-           }
-       }
-    }
-  else
-    {
-      size_t name_len = strlen (trans->name) + 1;
-      int need_so = 0;
-      struct known_trans *newp;
-
-      /* We have to continue looking for the module.  */
-      if (__gconv_path_elem == NULL)
-       __gconv_get_path ();
-
-      /* See whether we have to append .so.  */
-      if (name_len <= 4 || memcmp (&trans->name[name_len - 4], ".so", 3) != 0)
-       need_so = 1;
-
-      /* Create a new entry.  */
-      newp = (struct known_trans *) malloc (sizeof (struct known_trans)
-                                           + (__gconv_max_path_elem_len
-                                              + name_len + 3)
-                                           + name_len);
-      if (newp != NULL)
-       {
-         char *cp;
-
-         /* Clear the struct.  */
-         memset (newp, '\0', sizeof (struct known_trans));
-
-         /* Store a copy of the module name.  */
-         newp->info.name = cp = (char *) (newp + 1);
-         cp = __mempcpy (cp, trans->name, name_len);
-
-         newp->fname = cp;
-
-         /* Search in all the directories.  */
-         for (runp = __gconv_path_elem; runp->name != NULL; ++runp)
-           {
-             cp = __mempcpy (__stpcpy ((char *) newp->fname, runp->name),
-                             trans->name, name_len);
-             if (need_so)
-               memcpy (cp, ".so", sizeof (".so"));
-
-             if (open_translit (newp) == 0)
-               {
-                 /* We found a module.  */
-                 res = 0;
-                 break;
-               }
-           }
-
-         if (res)
-           newp->fname = NULL;
-
-         /* In any case we'll add the entry to our search tree.  */
-         if (__tsearch (newp, &search_tree, trans_compare) == NULL)
-           {
-             /* Yickes, this should not happen.  Unload the object.  */
-             res = 1;
-             /* XXX unload here.  */
-           }
-       }
-    }
-
-  __libc_lock_unlock (lock);
-
-  return res;
+  /* Transliteration module loading has been removed because it never
+     worked as intended and suffered from a security vulnerability.
+     Consequently, this function always fails.  */
+  return 1;
 }