From owner-dev-commits-src-all@freebsd.org Sat Mar 27 18:16:47 2021 Return-Path: Delivered-To: dev-commits-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 5210D57C3B8 for ; Sat, 27 Mar 2021 18:16:47 +0000 (UTC) (envelope-from jrtc27@jrtc27.com) Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4F76Vl1gzgz4XW3 for ; Sat, 27 Mar 2021 18:16:46 +0000 (UTC) (envelope-from jrtc27@jrtc27.com) Received: by mail-wm1-f47.google.com with SMTP id n11-20020a05600c4f8bb029010e5cf86347so7117718wmq.1 for ; Sat, 27 Mar 2021 11:16:46 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=l8GR87JrOaADdeQTEhBDuzoQ3zhiOD23ORjjpJTexy8=; b=B0bnGCRurj8dTMQoIdNmbEZLjzkvr6eheKsgXXO0dlsdzq31mOtToMz4reHB8PF/Kg PaJJyQLKZLyKLzrpeTlDyJLAnLvn4Y2w5F5n97x1woI5/xY1ssLUxWECNjgM0ZApLy1b 5zUJhStLPF5OQMG60loCZRG24/dgj5BTuU6AOiJIurrkmYwJm6bjOam46hsuzQz29wft WEpbmHlGVBDKiFp055qCZ5+14NRYQFpDviLhmV4RocvTN5g9EKexdRiLHmDkQ7czb2JI DGLqsZyMCDaaeH/xzcWHjcJoHIBAAZPZdAC+wDpYgfXhRFBGGYIJZ9zEK8/JDtv8twxb ZvDw== X-Gm-Message-State: AOAM532K6hInfDI/GRq2AP8QI/tN5HW0xD54CuxnUYYmIuxDhA0am7hn Mu00ZJKvRPy87/3p0cuQqUt9TXdzMhU3au0Z X-Google-Smtp-Source: ABdhPJxRaanRyqsX92CTicPDsrazICpTsb9czY555A/0MOCYSxYa7aaJ54zsiTnpJm5Pt2YQmjYUmw== X-Received: by 2002:a05:600c:2197:: with SMTP id e23mr17858383wme.39.1616869005683; Sat, 27 Mar 2021 11:16:45 -0700 (PDT) Received: from [192.168.149.251] (trinity-students-nat.trin.cam.ac.uk. [131.111.193.104]) by smtp.gmail.com with ESMTPSA id a67sm7502184wme.33.2021.03.27.11.16.45 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 27 Mar 2021 11:16:45 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.60.0.2.21\)) Subject: Re: git: 410556f1f10f - main - libctf: Fix an out-of-bounds read in ctf_lookup_by_name() From: Jessica Clarke In-Reply-To: <202103271806.12RI67Bp061468@gitrepo.freebsd.org> Date: Sat, 27 Mar 2021 18:16:44 +0000 Cc: "src-committers@freebsd.org" , "dev-commits-src-all@freebsd.org" , "dev-commits-src-main@freebsd.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <202103271806.12RI67Bp061468@gitrepo.freebsd.org> To: Mark Johnston X-Mailer: Apple Mail (2.3654.60.0.2.21) X-Rspamd-Queue-Id: 4F76Vl1gzgz4XW3 X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[] X-BeenThere: dev-commits-src-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for all branches of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Mar 2021 18:16:47 -0000 On 27 Mar 2021, at 18:06, Mark Johnston wrote: >=20 > The branch main has been updated by markj: >=20 > URL: = https://cgit.FreeBSD.org/src/commit/?id=3D410556f1f10fd35b350102725fd8504c= 3cb0afc8 >=20 > commit 410556f1f10fd35b350102725fd8504c3cb0afc8 > Author: Domagoj Stolfa > AuthorDate: 2021-03-27 18:04:12 +0000 > Commit: Mark Johnston > CommitDate: 2021-03-27 18:04:12 +0000 >=20 > libctf: Fix an out-of-bounds read in ctf_lookup_by_name() >=20 > When prefixes such as struct, union, etc. are compared with the = current > type (e.g. struct foo), a comparison is made with the prefix. The = code > currently assumes that every type is a valid C type with a prefix, > however at times, garbage ends up in this function causing an > unpredictable crash with DTrace due to the isspace(*p) call or > subsequent calls. An example that I've seen of this is the letter = 's' > being passed in, comparing true with struct as the comparison size = was > (q - p) =3D=3D 1, but then we increment p with the length of = "struct", > resulting in an out of bounds read. >=20 > Reviewed by: markj > MFC after: 1 week > Differential Revision: https://reviews.freebsd.org/D29435 > --- > cddl/contrib/opensolaris/common/ctf/ctf_lookup.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) >=20 > diff --git a/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c b/q > index aa58663309b6..5912cc1a36e8 100644 > --- a/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c > +++ b/cddl/contrib/opensolaris/common/ctf/ctf_lookup.c > @@ -132,8 +132,9 @@ ctf_lookup_by_name(ctf_file_t *fp, const char = *name) > continue; /* skip qualifier keyword */ >=20 > for (lp =3D fp->ctf_lookups; lp->ctl_prefix !=3D NULL; = lp++) { > - if (lp->ctl_prefix[0] =3D=3D '\0' || > - strncmp(p, lp->ctl_prefix, (size_t)(q - p)) = =3D=3D 0) { > + if ((size_t)(q - p) >=3D lp->ctl_len && > + (lp->ctl_prefix[0] =3D=3D '\0' || > + strncmp(p, lp->ctl_prefix, (size_t)(q - p)) = =3D=3D 0)) { > for (p +=3D lp->ctl_len; isspace(*p); = p++) > continue; /* skip prefix and = next ws */ We had a student porting DTrace to CheriBSD as a Master's project notice = this and get this fixed =E2=80=9Cupstream=E2=80=9D in Illumos[1], but = neglected to do so in FreeBSD (and it seems CheriBSD has an earlier version of the patch that I = requested be changed in the upstream review...); you might wish to pull that in = instead? It=E2=80=99s equivalent, just differently formatted, so adds noise to = the diff. Jess [1] = https://github.com/illumos/illumos-gate/commit/d15d17d4231f87f1571fa6d5853= 77206f360f667