Re: Buffer overflow in the StringQuotedWord() function
William Bader <[email protected]> Thu, 22 Oct 2020 22:55:28 +0000
| Newsgroups | gmane.comp.type-setting.lout |
|---|---|
| Message-ID | <DB6PR0201MB2471A94AE1ACF4345CB6E390C41D0@DB6PR0201MB2471.eurprd02.prod.outlook.com> |
--_004_DB6PR0201MB2471A94AE1ACF4345CB6E390C41D0DB6PR0201MB2471_ Content-Type: multipart/alternative; boundary="_000_DB6PR0201MB2471A94AE1ACF4345CB6E390C41D0DB6PR0201MB2471_" --_000_DB6PR0201MB2471A94AE1ACF4345CB6E390C41D0DB6PR0201MB2471_ Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable The attached patch should fix both of the CVEs. The one in StringQuotedWord was more complicated because it was due to a st= ring longer than MAX_BUFF, and when I fixed the access there, other places = had errors. The one in srcnext needed only an extra test in a loop. I tested the manual in doc/user before and after, and the only differences = seemed to be places that embedded the current time. Regards, William ________________________________ From: Reinoud Zandijk <[email protected]> Sent: Thursday, October 22, 2020 4:54 AM To: William Bader <[email protected]> Cc: Jeffrey Kingston <[email protected]>; Mat=ECj Cepl <mcepl@= cepl.eu>; [email protected] <[email protected]> Subject: Re: Buffer overflow in the StringQuotedWord() function On Wed, Oct 21, 2020 at 03:37:15AM +0000, William Bader wrote: > I have active projects that use lout, and my diff file of small fixes and > enhancement to lout-3.40 is now over 1300 lines. Would it be possible to > find a home for the 3.40 source on github or > https://www.freedesktop.org/wiki/ so that patches can at least be posted = as > issues even if there is never another release? Someone posted 3.39 as > https://github.com/thektulu/lout Someone posted some data fixes as > https://github.com/EPadronU/lout github has some other projects called lo= ut, > but I think that they are for Logging OUTput of web apps. Has anyone loo= ked > at the memory issues? StringQuotedWord lout-3.40/z39.c:254:66 looks easy= to > fix by checking that q < &buf[MAX_BUF-2] in the loop. srcnext > lout-3.40/z02.c:381:26 is more complicated. Does it have to check that li= mit > > mem_block? Regards, William A shared repository would be handy indeed. If don't know if github is a goo= d idea since it can frament a lot but it needs a maintainer/shared git accoun= t so it doesn't get lost. Its sad to see linux distro's already dumping it. With regards, Reinoud --_000_DB6PR0201MB2471A94AE1ACF4345CB6E390C41D0DB6PR0201MB2471_ Content-Type: text/html; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 2"> <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> <br> </div> <div> <div id=3D"appendonsend"></div> <div style=3D"font-family:Calibri,Helvetica,sans-serif; font-size:12pt; col= or:rgb(0,0,0)"> The attached patch should fix both of the CVEs.</div> <div style=3D"font-family:Calibri,Helvetica,sans-serif; font-size:12pt; col= or:rgb(0,0,0)"> The one in StringQuotedWord was more complicated because it was due to= a string longer than MAX_BUFF, and when I fixed the access there, other pl= aces had errors.</div> <div style=3D"font-family:Calibri,Helvetica,sans-serif; font-size:12pt; col= or:rgb(0,0,0)"> The one in srcnext needed only an extra test in a loop.</div> <div style=3D"font-family:Calibri,Helvetica,sans-serif; font-size:12pt; col= or:rgb(0,0,0)"> I tested the manual in doc/user before and after, and the only differences = seemed to be places that embedded the current time.</div> <div style=3D"font-family:Calibri,Helvetica,sans-serif; font-size:12pt; col= or:rgb(0,0,0)"> Regards, William</div> <div style=3D"font-family:Calibri,Helvetica,sans-serif; font-size:12pt; col= or:rgb(0,0,0)"> <br> </div> <hr tabindex=3D"-1" style=3D"display:inline-block; width:98%"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" co= lor=3D"#000000" style=3D"font-size:11pt"><b>From:</b> Reinoud Zandijk <r= [email protected]><br> <b>Sent:</b> Thursday, October 22, 2020 4:54 AM<br> <b>To:</b> William Bader <[email protected]><br> <b>Cc:</b> Jeffrey Kingston <[email protected]>; Mat=ECj= Cepl <[email protected]>; [email protected] <[email protected]= g><br> <b>Subject:</b> Re: Buffer overflow in the StringQuotedWord() function</fon= t> <div> </div> </div> <div class=3D"BodyFragment"><font size=3D"2"><span style=3D"font-size:11pt"= > <div class=3D"PlainText">On Wed, Oct 21, 2020 at 03:37:15AM +0000, William = Bader wrote:<br> > I have active projects that use lout, and my diff file of small fixes = and<br> > enhancement to lout-3.40 is now over 1300 lines. Would it be pos= sible to<br> > find a home for the 3.40 source on github or<br> > <a href=3D"https://www.freedesktop.org/wiki/">https://www.freedesktop.= org/wiki/</a> so that patches can at least be posted as<br> > issues even if there is never another release? Someone posted 3.= 39 as<br> > <a href=3D"https://github.com/thektulu/lout">https://github.com/thektu= lu/lout</a> Someone posted some data fixes as<br> > <a href=3D"https://github.com/EPadronU/lout">https://github.com/EPadro= nU/lout</a> github has some other projects called lout,<br> > but I think that they are for Logging OUTput of web apps. Has an= yone looked<br> > at the memory issues? StringQuotedWord lout-3.40/z39.c:254:66 lo= oks easy to<br> > fix by checking that q < &buf[MAX_BUF-2] in the loop. src= next<br> > lout-3.40/z02.c:381:26 is more complicated. Does it have to check that= limit<br> > > mem_block? Regards, William<br> <br> A shared repository would be handy indeed. If don't know if github is a goo= d<br> idea since it can frament a lot but it needs a maintainer/shared git accoun= t<br> so it doesn't get lost.<br> <br> Its sad to see linux distro's already dumping it.<br> <br> With regards,<br> Reinoud<br> <br> </div> </span></font></div> </div> </body> </html> --_000_DB6PR0201MB2471A94AE1ACF4345CB6E390C41D0DB6PR0201MB2471_-- --_004_DB6PR0201MB2471A94AE1ACF4345CB6E390C41D0DB6PR0201MB2471_ Content-Type: image/x-gimp-pat; name="lout-3.40-cve.pat" Content-Description: lout-3.40-cve.pat Content-Disposition: attachment; filename="lout-3.40-cve.pat"; size=3932; creation-date="Thu, 22 Oct 2020 22:47:31 GMT"; modification-date="Thu, 22 Oct 2020 22:47:44 GMT" Content-Transfer-Encoding: base64 LS0tIGxvdXQtMy40MC1jdmUvZXh0ZXJucy5oLQkyMDEzLTA2LTI1IDAwOjM0OjI0LjAwMDAwMDAw MCArMDEwMAorKysgbG91dC0zLjQwLWN2ZS9leHRlcm5zLmgJMjAyMC0xMC0yMiAyMjoyODowNS42 MTM5NjEwODUgKzAxMDAKQEAgLTI2MCw2ICsyNjAsOSBAQAogLyogICAgICAgICAgICAgICAgICAg ICAgdGhhdCBjYW4gYXBwZWFyIGNvcnJlY3RseSBvbiBvbmUgcGFnZS4gIENhbiBiZSAgICAgICAq LwogLyogICAgICAgICAgICAgICAgICAgICAgaW5jcmVhc2VkIHRvIGFueSBzbWFsbCBwb3NpdGl2 ZSBpbnRlZ2VyLiAgICAgICAgICAgICAqLwogLyogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAqLworLyogIE1B WF9GT1JNQVQgICAgICAgICAgVGhlIG1heGltdW0gbnVtYmVyIG9mIGNoYXJhY3RlcnMgZm9yIHNz Y2FuZiBmb3JtYXRzICAqLworLyogICAgICAgICAgICAgICAgICAgICAgZm9yIHNwbGl0dGluZyBz dHJpbmdzIHdpdGggdGFiLWRlbGltaXRlZCBmaWVsZHMuICAgICAqLworLyogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAqLwogLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqLwogCiAjZGVmaW5lCU1BWF9GVUxMX0xFTkdU SAk4Mzg4NjA3CS8qIDIqKjIzIC0gMSwgYWJvdXQgMTQ4IG1ldHJlcyAqLwpAQCAtMjc1LDYgKzI3 OCw3IEBACiAjZGVmaW5lCU1BWF9MRVhfU1RBQ0sJMjAKICNkZWZpbmUJTUFYX0NIQVJTCTI1Ngog I2RlZmluZSBNQVhfSENPUElFUwkzCisjZGVmaW5lIE1BWF9GT1JNQVQJMTAwCiAKIC8qKioqKioq KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioqKioqKioqKioqKi8KIC8qICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKi8KLS0tIGxvdXQtMy40MC1jdmUv ejAyLmMtCTIwMTAtMDktMDkgMjE6NTM6MjAuMDAwMDAwMDAwICswMTAwCisrKyBsb3V0LTMuNDAt Y3ZlL3owMi5jCTIwMjAtMTAtMjIgMjM6MjQ6NTguODI3NTQ3MzkxICswMTAwCkBAIC0zNzgsNyAr Mzc4LDcgQEAKICAgaWYoIGJsa3NpemUgIT0gMCAmJiBjaHB0IDwgbGltaXQgKQogICB7IGRlYnVn Y29uZDAoRExBLCBERCwgc3RhY2tfZnJlZSA8PSAxLCAic3JjbmV4dDogdHJhbnNmZXJyaW5nLiIp OwogICAgIGNvbCA9IGJ1ZjsKLSAgICB3aGlsZSggY2h0YmxbKCotLWNvbCA9ICotLWxpbWl0KV0g IT0gTkVXTElORSApOworICAgIHdoaWxlKCBjb2wgPiBtZW1fYmxvY2sgJiYgY2h0YmxbKCotLWNv bCA9ICotLWxpbWl0KV0gIT0gTkVXTElORSApOwogICAgIGZyc3QgPSBjb2wgKyAxOyAgbGltaXQr KzsgIGJsa3NpemUgPSAwOwogICB9CiAKLS0tIGxvdXQtMy40MC1jdmUvejMzLmMtCTIwMTAtMDkt MDkgMjE6NTQ6NTMuMDAwMDAwMDAwICswMTAwCisrKyBsb3V0LTMuNDAtY3ZlL3ozMy5jCTIwMjAt MTAtMjIgMjI6Mjg6MjIuOTI5MDk0NzI0ICswMTAwCkBAIC04NDcsNiArODQ3LDcgQEAKIEJPT0xF QU4gRGJSZXRyaWV2ZU5leHQoT0JKRUNUIGRiLCBCT09MRUFOICpnYWxsLCBPQkpFQ1QgKnN5bSwg RlVMTF9DSEFSICp0YWcsCiAgIEZVTExfQ0hBUiAqc2VxLCBGSUxFX05VTSAqZGZudW0sIGxvbmcg KmRmcG9zLCBpbnQgKmRsbnVtLCBsb25nICpjb250KQogeyBGVUxMX0NIQVIgbGluZVtNQVhfQlVG Rl0sICpjbGluZSwgZm5hbWVbTUFYX0JVRkZdOyBpbnQgc3ltbnVtOworICBjaGFyIGZvcm1hdFtN QVhfRk9STUFUXTsKICAgaWZkZWJ1ZyhEUFAsIEQsIFByb2ZpbGVPbigiRGJSZXRyaWV2ZU5leHQi KSk7CiAgIGRlYnVnMihEQlMsIERELCAiRGJSZXRyaWV2ZU5leHQoICVzLCAlbGQgKSIsIHN0cmlu ZyhkYiksICpjb250KTsKICAgYXNzZXJ0KHJlYWRpbmcoZGIpLCAiRGJSZXRyaWV2ZU5leHQ6IG5v dCByZWFkaW5nIik7CkBAIC04NTgsNiArODU5LDggQEAKICAgICByZXR1cm4gRkFMU0U7CiAgIH0K IAorICBzcHJpbnRmKGZvcm1hdCwgIiUlZCYlJSVkW15cdF1cdCUlJWRbXlx0XVx0JSUqW15cdF1c dCUlbGRcdCUlZFx0JSUlZFteXG5cZl0iLCBNQVhfQlVGRi0xLCBNQVhfQlVGRi0xLCBNQVhfQlVG Ri0xKTsKKwogICBpZiggaW5fbWVtb3J5KGRiKSApCiAgIHsKICAgICAvKiBnZXQgbmV4dCBlbnRy eSBmcm9tIGludGVybmFsIGRhdGFiYXNlICovCkBAIC04NjgsNyArODcxLDcgQEAKICAgICB9CiAg ICAgY2xpbmUgPSAoRlVMTF9DSEFSICopIGRiX2xpbmVzKGRiKVsqY29udF07CiAgICAgKmdhbGwg PSAoY2xpbmVbMF0gPT0gJzAnID8gMSA6IDApOwotICAgIHNzY2FuZigoY2hhciAqKSZjbGluZVsq Z2FsbF0sICIlZCYlW15cdF1cdCVbXlx0XVx0JSpbXlx0XVx0JWxkXHQlZFx0JVteXG5cZl0iLAor ICAgIHNzY2FuZigoY2hhciAqKSZjbGluZVsqZ2FsbF0sIGZvcm1hdCwKICAgICAgICZzeW1udW0s IHRhZywgc2VxLCBkZnBvcywgZGxudW0sIGZuYW1lKTsKICAgICAqY29udCA9ICpjb250ICsgMTsK ICAgfQpAQCAtODgyLDcgKzg4NSw3IEBACiAgICAgICByZXR1cm4gRkFMU0U7CiAgICAgfQogICAg ICpnYWxsID0gKGxpbmVbMF0gPT0gJzAnID8gMSA6IDApOwotICAgIHNzY2FuZigoY2hhciAqKSZs aW5lWypnYWxsXSwgIiVkJiVbXlx0XVx0JVteXHRdXHQlKlteXHRdXHQlbGRcdCVkXHQlW15cblxm XSIsCisgICAgc3NjYW5mKChjaGFyICopJmxpbmVbKmdhbGxdLCBmb3JtYXQsCiAgICAgICAmc3lt bnVtLCB0YWcsIHNlcSwgZGZwb3MsIGRsbnVtLCBmbmFtZSk7CiAgICAgKmNvbnQgPSBmdGVsbChk Yl9maWxlcChkYikpOwogICB9Ci0tLSBsb3V0LTMuNDAtY3ZlL3ozOS5jLQkyMDEwLTA5LTA5IDIx OjU1OjEzLjAwMDAwMDAwMCArMDEwMAorKysgbG91dC0zLjQwLWN2ZS96MzkuYwkyMDIwLTEwLTIy IDIyOjI4OjI4LjQzOTEzNzI1MiArMDEwMApAQCAtNzksMTEgKzc5LDEzIEBACiBpbnQgc3RyY29s bGNtcChjaGFyICphLCBjaGFyICpiKQogeyBjaGFyIGExW01BWF9CVUZGXSwgYTJbTUFYX0JVRkZd LCBhM1tNQVhfQlVGRl07CiAgIGNoYXIgYjFbTUFYX0JVRkZdLCBiMltNQVhfQlVGRl0sIGIzW01B WF9CVUZGXTsKKyAgY2hhciBmb3JtYXRbTUFYX0ZPUk1BVF07CiAgIGludCBvcmRlcjsKKyAgc3By aW50Zihmb3JtYXQsICIlJSVkW15cdF1cdCUlJWRbXlx0XVx0JSUlZFteXHRdIiwgTUFYX0JVRkYt MSwgTUFYX0JVRkYtMSwgTUFYX0JVRkYtMSk7CiAgIGExWzBdID0gYTJbMF0gPSBhM1swXSA9ICdc MCc7Ci0gIHNzY2FuZihhLCAiJVteXHRdXHQlW15cdF1cdCVbXlx0XSIsIGExLCBhMiwgYTMpOwor ICBzc2NhbmYoYSwgZm9ybWF0LCBhMSwgYTIsIGEzKTsKICAgYjFbMF0gPSBiMlswXSA9IGIzWzBd ID0gJ1wwJzsKLSAgc3NjYW5mKGIsICIlW15cdF1cdCVbXlx0XVx0JVteXHRdIiwgYjEsIGIyLCBi Myk7CisgIHNzY2FuZihiLCBmb3JtYXQsIGIxLCBiMiwgYjMpOwogICBvcmRlciA9IHN0cmNvbGwo YTEsIGIxKTsKICAgaWYoIG9yZGVyID09IDAgKQogICB7CkBAIC0yNTEsNyArMjUzLDcgQEAKICAg KnErKyA9IENIX1FVT1RFOwogICBmb3IoIHAgPSBzdHJpbmcoeCk7ICAqcCAhPSAnXDAnOyAgcCsr ICkKICAgeyAKLSAgICBmb3IoIHIgPSAoRlVMTF9DSEFSICopIHF1b3RlZF9zdHJpbmdbKnBdOyAg KnIgIT0gJ1wwJzsgICpxKysgPSAqcisrICk7CisgICAgZm9yKCByID0gKEZVTExfQ0hBUiAqKSBx dW90ZWRfc3RyaW5nWypwXTsgICpyICE9ICdcMCcgJiYgcSA8ICZidWZmW01BWF9CVUZGLTJdOyAg KnErKyA9ICpyKysgKTsKICAgfQogICAqcSsrID0gQ0hfUVVPVEU7CiAgICpxKysgPSAnXDAnOwo= --_004_DB6PR0201MB2471A94AE1ACF4345CB6E390C41D0DB6PR0201MB2471_--