Backport of: From 0f384c88a241bbbd884487b1c40b7b75f1e638d3 Mon Sep 17 00:00:00 2001 From: Krzesimir Nowak Date: Wed, 10 Feb 2021 23:51:07 +0100 Subject: [PATCH] gbytearray: Do not accept too large byte arrays GByteArray uses guint for storing the length of the byte array, but it also has a constructor (g_byte_array_new_take) that takes length as a gsize. gsize may be larger than guint (64 bits for gsize vs 32 bits for guint). It is possible to call the function with a value greater than G_MAXUINT, which will result in silent length truncation. This may happen as a result of unreffing GBytes into GByteArray, so rather be loud about it. (Test case tweaked by Philip Withnall.) (Backport 2.66: Add #include gstrfuncsprivate.h in the test case for `g_memdup2()`.) Upstream-Status: Backport [https://mirrors.ocf.berkeley.edu/ubuntu/pool/main/g/glib2.0/glib2.0_2.64.6-1~ubuntu20.04.3.debian.tar.xz] CVE: CVE-2021-27218 Signed-off-by: Neetika Singh Signed-off-by: Ranjitsinh Rathod --- glib/garray.c | 6 ++++++ glib/gbytes.c | 4 ++++ glib/tests/bytes.c | 35 ++++++++++++++++++++++++++++++++++- 3 files changed, 44 insertions(+), 1 deletion(-) --- a/glib/garray.c +++ b/glib/garray.c @@ -2234,6 +2234,10 @@ g_byte_array_steal (GByteArray *array, * Create byte array containing the data. The data will be owned by the array * and will be freed with g_free(), i.e. it could be allocated using g_strdup(). * + * Do not use it if @len is greater than %G_MAXUINT. #GByteArray + * stores the length of its data in #guint, which may be shorter than + * #gsize. + * * Since: 2.32 * * Returns: (transfer full): a new #GByteArray @@ -2245,6 +2249,8 @@ g_byte_array_new_take (guint8 *data, GByteArray *array; GRealArray *real; + g_return_val_if_fail (len <= G_MAXUINT, NULL); + array = g_byte_array_new (); real = (GRealArray *)array; g_assert (real->data == NULL); --- a/glib/gbytes.c +++ b/glib/gbytes.c @@ -519,6 +519,10 @@ g_bytes_unref_to_data (GBytes *bytes, * g_bytes_new(), g_bytes_new_take() or g_byte_array_free_to_bytes(). In all * other cases the data is copied. * + * Do not use it if @bytes contains more than %G_MAXUINT + * bytes. #GByteArray stores the length of its data in #guint, which + * may be shorter than #gsize, that @bytes is using. + * * Returns: (transfer full): a new mutable #GByteArray containing the same byte data * * Since: 2.32 --- a/glib/tests/bytes.c +++ b/glib/tests/bytes.c @@ -10,12 +10,12 @@ */ #undef G_DISABLE_ASSERT -#undef G_LOG_DOMAIN #include #include #include #include "glib.h" +#include "glib/gstrfuncsprivate.h" /* Keep in sync with glib/gbytes.c */ struct _GBytes @@ -334,6 +334,38 @@ test_to_array_transferred (void) } static void +test_to_array_transferred_oversize (void) +{ + g_test_message ("g_bytes_unref_to_array() can only take GBytes up to " + "G_MAXUINT in length; test that longer ones are rejected"); + + if (sizeof (guint) >= sizeof (gsize)) + { + g_test_skip ("Skipping test as guint is not smaller than gsize"); + } + else if (g_test_undefined ()) + { + GByteArray *array = NULL; + GBytes *bytes = NULL; + gpointer data = g_memdup2 (NYAN, N_NYAN); + gsize len = ((gsize) G_MAXUINT) + 1; + + bytes = g_bytes_new_take (data, len); + g_test_expect_message (G_LOG_DOMAIN, G_LOG_LEVEL_CRITICAL, + "g_byte_array_new_take: assertion 'len <= G_MAXUINT' failed"); + array = g_bytes_unref_to_array (g_steal_pointer (&bytes)); + g_test_assert_expected_messages (); + g_assert_null (array); + + g_free (data); + } + else + { + g_test_skip ("Skipping test as testing undefined behaviour is disabled"); + } +} + +static void test_to_array_two_refs (void) { gconstpointer memory; @@ -410,6 +442,7 @@ main (int argc, char *argv[]) g_test_add_func ("/bytes/to-array/transfered", test_to_array_transferred); g_test_add_func ("/bytes/to-array/two-refs", test_to_array_two_refs); g_test_add_func ("/bytes/to-array/non-malloc", test_to_array_non_malloc); + g_test_add_func ("/bytes/to-array/transferred/oversize", test_to_array_transferred_oversize); g_test_add_func ("/bytes/null", test_null); return g_test_run ();