CVE-2014-6040: Crashes on invalid input in IBM gconv modules [BZ #17325]

These changes are based on the fix for BZ #14134 in commit
6e230d11837f3ae7b375ea69d7905f0d18eb79e5.

diff --git a/ChangeLog b/ChangeLog
index 1669b71cad3af14d210d8ee484390ba22165e705..8423dd53cd4caa0b6da22f87c5c9af524f7d5880 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,20 @@
+2014-09-03  Florian Weimer  <fweimer@redhat.com>
+
+       [BZ #17325]
+       * iconvdata/ibm1364.c (BODY): Fix check for sentinel.
+       * iconvdata/ibm932.c (BODY): Replace invalid sentinel check with
+       assert.
+       * iconvdata/ibm933.c (BODY): Fix check for sentinel.
+       * iconvdata/ibm935.c (BODY): Likewise.
+       * iconvdata/ibm937.c (BODY): Likewise.
+       * iconvdata/ibm939.c (BODY): Likewise.
+       * iconvdata/ibm943.c (BODY): Replace invalid sentinel check with
+       assert.
+       * iconvdata/Makefile (iconv-test.out): Pass module list to test
+       script.
+       * iconvdata/run-iconv-test.sh: New test loop for checking for
+       decoder crashers.
+
 2013-09-11  Will Newton  <will.newton@linaro.org>
 
        [BZ #15857]

diff --git a/NEWS b/NEWS
index 86f3232737848c7adc33ace434a392a254007c56..022da81f2cf0ac361c05d63ad5e2d05f4c159289 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,7 +10,12 @@ Version 2.16.1
 * The following bugs are resolved with this release:
 
   6530, 14195, 14547, 14459, 14476, 14562, 14621, 14648, 14699, 14756, 14831,
-  15078, 15754, 15755, 16072.
+  15078, 15754, 15755, 16072, 17325.
+
+* Decoding a crafted input sequence in the character sets IBM933, IBM935,
+  IBM937, IBM939, IBM1364 could result in an out-of-bounds array read,
+  resulting a denial-of-service security vulnerability in applications which
+  use functions related to iconv. (CVE-2014-6040)
 
 * CVE-2013-4332 The pvalloc, valloc, memalign, posix_memalign and
   aligned_alloc functions could allocate too few bytes or corrupt the

diff --git a/iconvdata/Makefile b/iconvdata/Makefile
index eac51ba5720de0dc5794f58ac57766ecbb73fd3e..74d468fb0288d4a9ec9c88ce16302dbc75b105ab 100644 (file)
--- a/iconvdata/Makefile
+++ b/iconvdata/Makefile
@@ -299,7 +299,9 @@ $(objpfx)tst-iconv7.out: $(objpfx)gconv-modules \
 $(objpfx)iconv-test.out: run-iconv-test.sh $(objpfx)gconv-modules \
                         $(addprefix $(objpfx),$(modules.so)) \
                         $(common-objdir)/iconv/iconv_prog TESTS
-       $(SHELL) -e $< $(common-objdir) > $@
+       iconv_modules="$(modules)" \
+       $(SHELL) $< $(common-objdir) '$(test-wrapper-env)' \
+                '$(run-program-env)' > $@
 
 $(objpfx)tst-tables.out: tst-tables.sh $(objpfx)gconv-modules \
                         $(addprefix $(objpfx),$(modules.so)) \

diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c
index 09202a29f56895e53ad73bb01044a487d3137055..dc71cd728b764d1ea45a348f31791568541eaaba 100644 (file)
--- a/iconvdata/ibm1364.c
+++ b/iconvdata/ibm1364.c
@@ -220,7 +220,8 @@ enum
          ++rp2;                                                              \
                                                                              \
        uint32_t res;                                                         \
-       if (__builtin_expect (ch < rp2->start, 0)                             \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
+           || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = DB_TO_UCS4[ch + rp2->idx],                              \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \
          {                                                                   \

diff --git a/iconvdata/ibm932.c b/iconvdata/ibm932.c
index bd070e19fd246c96d9ce428af83db836d8a11af0..d88185c12630d9f2a2620ba79c34abb22cf7c1d8 100644 (file)
--- a/iconvdata/ibm932.c
+++ b/iconvdata/ibm932.c
@@ -73,11 +73,12 @@
          }                                                                   \
                                                                              \
        ch = (ch * 0x100) + inptr[1];                                         \
+       /* ch was less than 0xfd.  */                                         \
+       assert (ch < 0xfd00);                                                 \
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
-           || __builtin_expect (ch < rp2->start, 0)                          \
+       if (__builtin_expect (ch < rp2->start, 0)                             \
            || (res = __ibm932db_to_ucs4[ch + rp2->idx],                      \
            __builtin_expect (res, '\1') == 0 && ch !=0))                     \
          {                                                                   \

diff --git a/iconvdata/ibm933.c b/iconvdata/ibm933.c
index 12c20710d3bf458bf749b753e82d6e5807046341..9d9886ff19b690da3ac99bd6e6ad4ea08070a9f7 100644 (file)
--- a/iconvdata/ibm933.c
+++ b/iconvdata/ibm933.c
@@ -161,7 +161,7 @@ enum
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
            || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = __ibm933db_to_ucs4[ch + rp2->idx],                      \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \

diff --git a/iconvdata/ibm935.c b/iconvdata/ibm935.c
index 110d513864156969cf6f7a40d8c32c9739c65b18..966a09225461dcef5b3e7e01b2d253db71c7f715 100644 (file)
--- a/iconvdata/ibm935.c
+++ b/iconvdata/ibm935.c
@@ -161,7 +161,7 @@ enum
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
            || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = __ibm935db_to_ucs4[ch + rp2->idx],                      \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \

diff --git a/iconvdata/ibm937.c b/iconvdata/ibm937.c
index c88f9e29674aef9386a16e9cc6ad7d205b316920..20dd9bfc84b7be4c4c9258929f31f0a14ccfbd7d 100644 (file)
--- a/iconvdata/ibm937.c
+++ b/iconvdata/ibm937.c
@@ -161,7 +161,7 @@ enum
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
            || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = __ibm937db_to_ucs4[ch + rp2->idx],                      \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \

diff --git a/iconvdata/ibm939.c b/iconvdata/ibm939.c
index 6eefabc5de45e2f2444bdb4db9118df5a2b95939..482f26ab2ba60f756ddab5f63772d46bca729c0c 100644 (file)
--- a/iconvdata/ibm939.c
+++ b/iconvdata/ibm939.c
@@ -161,7 +161,7 @@ enum
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
+       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
            || __builtin_expect (ch < rp2->start, 0)                          \
            || (res = __ibm939db_to_ucs4[ch + rp2->idx],                      \
                __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \

diff --git a/iconvdata/ibm943.c b/iconvdata/ibm943.c
index bc2cec373d4326b8456110eb049935a02dda897e..e020d0972681d77650f681fad7f5721c046e56be 100644 (file)
--- a/iconvdata/ibm943.c
+++ b/iconvdata/ibm943.c
@@ -74,11 +74,12 @@
          }                                                                   \
                                                                              \
        ch = (ch * 0x100) + inptr[1];                                         \
+       /* ch was less than 0xfd.  */                                         \
+       assert (ch < 0xfd00);                                                 \
        while (ch > rp2->end)                                                 \
          ++rp2;                                                              \
                                                                              \
-       if (__builtin_expect (rp2 == NULL, 0)                                 \
-           || __builtin_expect (ch < rp2->start, 0)                          \
+       if (__builtin_expect (ch < rp2->start, 0)                             \
            || (res = __ibm943db_to_ucs4[ch + rp2->idx],                      \
            __builtin_expect (res, '\1') == 0 && ch !=0))                     \
          {                                                                   \

diff --git a/iconvdata/run-iconv-test.sh b/iconvdata/run-iconv-test.sh
index 60be69f628c4452ffa9759795171dac6b96f3598..f689b6ff58ee2b0f77905d46ff216b8c54a89fb1 100755 (executable)
--- a/iconvdata/run-iconv-test.sh
+++ b/iconvdata/run-iconv-test.sh
@@ -185,6 +185,24 @@ while read utf8 from filename; do
 
 done < TESTS2
 
+# Check for crashes in decoders.
+printf '\016\377\377\377\377\377\377\377' > $temp1
+for from in $iconv_modules ; do
+    echo $ac_n "test decoder $from $ac_c"
+    PROG=`eval echo $ICONV`
+    if $PROG < $temp1 >/dev/null 2>&1 ; then
+       : # fall through
+    else
+       status=$?
+       if test $status -gt 1 ; then
+           echo "/FAILED"
+           failed=1
+           continue
+       fi
+    fi
+    echo "OK"
+done
+
 exit $failed
 # Local Variables:
 #  mode:shell-script