Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix stack buffer overflows reported in gentoo bug 543310 #2

Closed
wants to merge 3 commits into from
Closed

Fix stack buffer overflows reported in gentoo bug 543310 #2

wants to merge 3 commits into from

Commits on Oct 27, 2019

  1. bdeltaReconstructDCBuff: validate int_size 

    The int_size must be in the range 1 to 4 in order to avoid BUFF_SIZE
overflow or a negative left shift.

Bug: https://bugs.gentoo.org/543310
Reported-by: Aidan Thornton <makosoft@googlemail.com>
Signed-off-by: Zac Medico <zmedico@gentoo.org>
    @zmedico
    zmedico committed Oct 27, 2019
    Configuration menu
    Copy the full SHA
    dd84600 View commit details
    Browse the repository at this point in the history

  2. gdiffReconstructDCBuff: increase buff_size from 5 to 13 

    The buff_size must be at least 13 in order to accomodate cread and
readUBytesBE calls relative to buff + 1 with ob = 8 and lb = 4.

Bug: https://bugs.gentoo.org/543310
Reported-by: Aidan Thornton <makosoft@googlemail.com>
Signed-off-by: Zac Medico <zmedico@gentoo.org>
    @zmedico
    zmedico committed Oct 27, 2019
    Configuration menu
    Copy the full SHA
    db4a965 View commit details
    Browse the repository at this point in the history

  3. readXDInt: limit count to 31 

    Since buff points to a 32-byte stack buffer, count must not exceed 31.

Bug: https://bugs.gentoo.org/543310
Reported-by: Aidan Thornton <makosoft@googlemail.com>
Signed-off-by: Zac Medico <zmedico@gentoo.org>
    @zmedico
    zmedico committed Oct 27, 2019
    Configuration menu
    Copy the full SHA
    4e60e54 View commit details
    Browse the repository at this point in the history