Changeset 456 for trunk

Timestamp:

Jul 13, 2014, 12:13:33 PM (10 years ago)

Author:

katerina

Message:

Fix for ticket #356 (minor bug in exepack_fill.c).

Location:

trunk

Files:

• docs/Changelog (modified) (1 diff)
• src/exepack.c (modified) (8 diffs)
• src/exepack_fill.c (modified) (3 diffs)

trunk/docs/Changelog

@@ -4 +4 @@
         * Allow multiple exclusions for SUID check
         * Use calloc instead of malloc
+        * Add overflow check in minilzo.c (but the potential integer
+          overflow [CVE-2014-4607,LMS-2014-06-16-1] is irrelevant anyway
+          because the function is never used on external data).
+        * Fixed a minor bug in exepack_fill.c that was unearthed by the minilzo
+          overflow check (the required buffer length information for the check
+          wasn't provided)
 
 3.1.1 (01-0-2014):

trunk/src/exepack.c

@@ -84 +84 @@
 {
   int file;
+  long result;
 
   unsigned long i    = argc; /* dummy use of argc to fix compiler warning */
@@ -129 +130 @@
   out_len = (unsigned long) programlen_compressed_0;
   len     = (unsigned long) programlen_0;
+  in_len  = len;
 
   outbuf  = program_0;
@@ -260 +262 @@
     } 
 
-  write(file, inbuf, in_len);
+  result = (long) write(file, inbuf, in_len);
+  if (result < 0 || in_len != (lzo_uint) result)
+    {
+      return (5);
+    }
 
 #if defined(__linux__)
@@ -266 +272 @@
   if ( 0 != fstat(file, &sbuf))
     {
-      return (5);
+      return (6);
     } 
   
@@ -276 +282 @@
   if ( 0 != fstat(file, &fbuf))
     {
-      return (6);
+      return (7);
     } 
 
@@ -288 +294 @@
     {
       close  ( file );
-      return ( 6 );
+      return ( 8 );
     }
   
@@ -312 +318 @@
       fcntl  (file, F_SETFD, FD_CLOEXEC);
       execve (pname, argv, environ); 
-      return (8);
+      return (9);
     }
 #endif
@@ -325 +331 @@
       execve (fname, argv, environ);
       unlink (fname);
-      return (9);
+      return (10);
     } 
   else if (i == 0)

trunk/src/exepack_fill.c

@@ -169 +169 @@
 {
   FILE * fd;
-  long   clen;
+  unsigned long   clen;
   char * data;
   struct stat sbuf;
@@ -222 +222 @@
     return (-1);
 
-  fread  (data, 1, clen, fd);
+  if (clen != fread  (data, 1, clen, fd))
+    return (-1);
   fclose (fd);
 
@@ -337 +338 @@
       return (8);
     }
-  status = replaceData (data, clen, "CONTAINER", outbuf, out_len);
+  status = replaceData (data, clen, "CONTAINER", (char *) outbuf, out_len);
   if (status < 0)
     {