From: Oliver Kurth <okurth@vmware.com>
Date: Fri, 15 Sep 2017 18:22:52 +0000 (-0700)
Subject: Check for bad length fields for input byte buffers in dataMap code.
X-Git-Tag: stable-10.2.0~644
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f9ca53c4a687a98d59252da4ef01f7aeca567c6c;p=thirdparty%2Fopen-vm-tools.git

Check for bad length fields for input byte buffers in dataMap code.
---

diff --git a/open-vm-tools/lib/dataMap/dataMap.c b/open-vm-tools/lib/dataMap/dataMap.c
index dbc7139ee..6dbc6ac80 100644
--- a/open-vm-tools/lib/dataMap/dataMap.c
+++ b/open-vm-tools/lib/dataMap/dataMap.c
@@ -522,6 +522,10 @@ DecodeString(char **buf,         // IN/OUT
       return res;
    }
 
+   if (*strLen <= 0) {
+      return DMERR_BAD_DATA;
+   }
+
    if (*left < *strLen) {
       return DMERR_TRUNCATED_DATA;
    }
@@ -600,12 +604,19 @@ DecodeInt64List(char **buf,        // IN/OUT
    int32 listLen;
    int64 *numList = NULL;
    ErrorCode res;
+   int32 i;
 
    res = DecodeInt32(buf, left, &listLen);
+   if (res != DMERR_SUCCESS) {
+      return res;
+   }
 
-   if (res == DMERR_SUCCESS) {
-      int32 i;
+   if (listLen < 0 || listLen > *left / sizeof(int64)) {
+      /* listLen can be zero to support an empty list */
+      return DMERR_BAD_DATA;
+   }
 
+   if (listLen) {
       numList = (int64 *)malloc(sizeof(int64) * listLen);
       if (numList == NULL) {
          return DMERR_INSUFFICIENT_MEM;
@@ -617,15 +628,15 @@ DecodeInt64List(char **buf,        // IN/OUT
             break;
          }
       }
+   }
 
-      if (res == DMERR_SUCCESS) {
-         res = AddEntry_Int64List(that, fieldId, numList, listLen);
-      }
+   if (res == DMERR_SUCCESS) {
+      res = AddEntry_Int64List(that, fieldId, numList, listLen);
+   }
 
-      if (res != DMERR_SUCCESS) {
-         /* clean up memory */
-         free(numList);
-      }
+   if (res != DMERR_SUCCESS) {
+      /* clean up memory */
+      free(numList);
    }
 
    return res;
@@ -1434,13 +1445,24 @@ DecodeStringList(char **buf,           // IN
       return res;
    }
 
-   strList = (char **)calloc(listSize + 1, sizeof(char *));
-   strLens = (int32 *)malloc(sizeof(int32) * listSize);
+   if (listSize < 0 || listSize > *left / sizeof(int32)) {
+      /* listSize can be zero to support an empty list */
+      return DMERR_BAD_DATA;
+   }
 
-   if (strList == NULL || strLens == NULL) {
-      FreeStringList(strList, strLens);
+   strList = (char **)calloc(listSize + 1, sizeof(char *));
+   if (strList == NULL) {
       return DMERR_INSUFFICIENT_MEM;
    }
+   if (listSize) {
+      strLens = (int32 *)malloc(sizeof(int32) * listSize);
+      if (strLens == NULL) {
+         FreeStringList(strList, strLens);
+         return DMERR_INSUFFICIENT_MEM;
+      }
+   } else {
+      strLens = NULL;
+   }
 
    for (i = 0; i < listSize; i++) {
       res = DecodeString(buf, left, &strList[i], &strLens[i]);
diff --git a/open-vm-tools/lib/include/dataMap.h b/open-vm-tools/lib/include/dataMap.h
index a2a1dfe19..1add3e023 100644
--- a/open-vm-tools/lib/include/dataMap.h
+++ b/open-vm-tools/lib/include/dataMap.h
@@ -55,7 +55,8 @@ typedef enum {
    DMERR_UNKNOWN_TYPE,             /* type unknow in decoding */
    DMERR_TRUNCATED_DATA,           /* more data expected during decoding */
    DMERR_BUFFER_TOO_SMALL,         /* a user buffer is too small */
-   DMERR_INTEGER_OVERFLOW         /* an integer overflow happened */
+   DMERR_INTEGER_OVERFLOW,         /* an integer overflow happened */
+   DMERR_BAD_DATA                  /* bad data during decoding */
 } ErrorCode;
 
 /*