Maniphest T8397

_gcry_sexp_canon_len unbounded traversal with length==0
Open, NormalPublic
Actions

Assigned To
• gniibe
Authored By
• gniibe
Wed, Aug 5, 8:08 AM
Tags
Subscribers
• alexk
• gniibe
m.eik
• werner

Description

In src/sexp.c:2200-2230 every bounds check in _gcry_sexp_canon_len is
written as if (length && ...), so with the documented length==0 calling
mode they all become no-ops. The decimal length prefix then drives an
unbounded forward jump

Reported-by: X1AOxiang

Event Timeline

• gniibe created this task.Wed, Aug 5, 8:08 AM
• gniibe claimed this task.Wed, Aug 5, 8:14 AM
• gniibe lowered the priority of this task from Unbreak Now! to Normal.Wed, Aug 5, 9:00 AM

It is documented as:

If LENGTH is not 0, the maximum length to scan is given; this can be used for syntax checks of data passed from outside.

There is no contradiction here.

Don't use gcry_sexp_canon_len with untrusted input and with LENGTH=0

• gniibe edited projects, added Documentation; removed Security.Wed, Aug 5, 9:01 AM
• gniibe mentioned this in Unknown Object (Maniphest Task).Mon, Aug 10, 3:55 AM
• gniibe updated the task description. (Show Details)Tue, Aug 11, 3:43 AM
• gniibe shifted this object from the Restricted Space space to the S1 Public space.Tue, Aug 11, 4:32 AM
• gniibe changed the visibility from "g10code (Project)" to "Public (No Login Required)".
• gniibe added a project: Not A Bug.Tue, Aug 11, 4:36 AM