Skip to content
Permalink
Browse files

Issue 747 (and others?): Avoid OOB read when parsing multiple long lines

The mtree bidder needs to look several lines ahead
in the input.  It does this by extending the read-ahead
and parsing subsequent lines from the same growing buffer.
A bookkeeping error when extending the read-ahead would
sometimes lead it to significantly over-count the
size of the line being read.
  • Loading branch information...
kientzle committed Sep 19, 2016
1 parent 2bc4e83 commit eec077f52bfa2d3f7103b4b74d52572ba8a15aca
@@ -449,6 +449,7 @@ libarchive_test_SOURCES= \
libarchive/test/test_read_format_lha_bugfix_0.c \
libarchive/test/test_read_format_lha_filename.c \
libarchive/test/test_read_format_mtree.c \
libarchive/test/test_read_format_mtree_crash747.c \
libarchive/test/test_read_format_pax_bz2.c \
libarchive/test/test_read_format_rar.c \
libarchive/test/test_read_format_rar_encryption_data.c \
@@ -301,6 +301,15 @@ get_line_size(const char *b, ssize_t avail, ssize_t *nlsize)
return (avail);
}

/*
* <---------------- ravail --------------------->
* <-- diff ------> <--- avail ----------------->
* <---- len ----------->
* | Previous lines | line being parsed nl extra |
* ^
* b
*
*/
static ssize_t
next_line(struct archive_read *a,
const char **b, ssize_t *avail, ssize_t *ravail, ssize_t *nl)
@@ -339,7 +348,7 @@ next_line(struct archive_read *a,
*b += diff;
*avail -= diff;
tested = len;/* Skip some bytes we already determinated. */
len = get_line_size(*b, *avail, nl);
len = get_line_size(*b + len, *avail - len, nl);
if (len >= 0)
len += tested;
}
@@ -138,6 +138,7 @@ IF(ENABLE_TEST)
test_read_format_lha_bugfix_0.c
test_read_format_lha_filename.c
test_read_format_mtree.c
test_read_format_mtree_crash747.c
test_read_format_pax_bz2.c
test_read_format_rar.c
test_read_format_rar_encryption_data.c
@@ -0,0 +1,44 @@
/*-
* Copyright (c) 2003-2016 Tim Kientzle
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "test.h"


/*
* Reproduce the crash reported in Github Issue #747.
*/
DEFINE_TEST(test_read_format_mtree_crash747)
{
const char *reffile = "test_read_format_mtree_crash747.mtree.bz2";
struct archive *a;

extract_reference_file(reffile);

assert((a = archive_read_new()) != NULL);
assertEqualIntA(a, ARCHIVE_OK, archive_read_support_filter_bzip2(a));
assertEqualIntA(a, ARCHIVE_OK, archive_read_support_format_mtree(a));
assertEqualIntA(a, ARCHIVE_FATAL, archive_read_open_filename(a, reffile, 10240));
assertEqualInt(ARCHIVE_OK, archive_read_free(a));
}

@@ -0,0 +1,6 @@
begin 600 test_read_format_mtree_crash747.mtree.bz2
M0EIH.3%!62936:OH@(@``'/[@,`0`@!``'^```)A@9\`$`@@`'4)049!IIH!
MM021-0,F@&@6````9%>$(K!GIC*XFR0`$```J0+:$XP```!D-F)H[#SE9+2'
4+E"L=ASXUI%R(I"HD'ZA(5?1`Q``
`
end

0 comments on commit eec077f

Please sign in to comment.
You can’t perform that action at this time.