From owner-svn-ports-head@freebsd.org Sat Feb 10 21:52:46 2018 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 5E0F6F21AED; Sat, 10 Feb 2018 21:52:46 +0000 (UTC) (envelope-from dbaio@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 13D847439A; Sat, 10 Feb 2018 21:52:46 +0000 (UTC) (envelope-from dbaio@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 0EBC019D46; Sat, 10 Feb 2018 21:52:46 +0000 (UTC) (envelope-from dbaio@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w1ALqjOo054895; Sat, 10 Feb 2018 21:52:45 GMT (envelope-from dbaio@FreeBSD.org) Received: (from dbaio@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w1ALqjT8054892; Sat, 10 Feb 2018 21:52:45 GMT (envelope-from dbaio@FreeBSD.org) Message-Id: <201802102152.w1ALqjT8054892@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: dbaio set sender to dbaio@FreeBSD.org using -f From: "Danilo G. Baio" Date: Sat, 10 Feb 2018 21:52:45 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r461437 - in head/net-p2p/libtorrent: . files X-SVN-Group: ports-head X-SVN-Commit-Author: dbaio X-SVN-Commit-Paths: in head/net-p2p/libtorrent: . files X-SVN-Commit-Revision: 461437 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Feb 2018 21:52:46 -0000 Author: dbaio Date: Sat Feb 10 21:52:45 2018 New Revision: 461437 URL: https://svnweb.freebsd.org/changeset/ports/461437 Log: net-p2p/libtorrent: Fix remote DoS Calls into build_benocde that use %zu could crash on 64 bit machines due to the size change of size_t. Someone can force READ_ENC_IA to fail allowing an internal_error to be thrown and bring down the client, throw handshake_error instead. PR: 224664 Submitted by: Henry David Bartholomew Approved by: maintainer timeout (pipfstarrd@openmailbox.org, > 2 weeks) MFH: 2018Q1 Security: e4dd787e-0ea9-11e8-95f2-005056925db4 Added: head/net-p2p/libtorrent/files/patch-fix-build-bencoders-callers-crash (contents, props changed) Modified: head/net-p2p/libtorrent/Makefile head/net-p2p/libtorrent/distinfo Modified: head/net-p2p/libtorrent/Makefile ============================================================================== --- head/net-p2p/libtorrent/Makefile Sat Feb 10 21:45:06 2018 (r461436) +++ head/net-p2p/libtorrent/Makefile Sat Feb 10 21:52:45 2018 (r461437) @@ -2,7 +2,7 @@ PORTNAME= libtorrent PORTVERSION= 0.13.6 -PORTREVISION= 4 +PORTREVISION= 5 CATEGORIES= net-p2p MASTER_SITES= http://rtorrent.net/downloads/ Modified: head/net-p2p/libtorrent/distinfo ============================================================================== --- head/net-p2p/libtorrent/distinfo Sat Feb 10 21:45:06 2018 (r461436) +++ head/net-p2p/libtorrent/distinfo Sat Feb 10 21:52:45 2018 (r461437) @@ -1,2 +1,3 @@ +TIMESTAMP = 1518295243 SHA256 (libtorrent-0.13.6.tar.gz) = 2838a08c96edfd936aff8fbf99ecbb930c2bfca3337dd1482eb5fccdb80d5a04 SIZE (libtorrent-0.13.6.tar.gz) = 781253 Added: head/net-p2p/libtorrent/files/patch-fix-build-bencoders-callers-crash ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/net-p2p/libtorrent/files/patch-fix-build-bencoders-callers-crash Sat Feb 10 21:52:45 2018 (r461437) @@ -0,0 +1,45 @@ +# https://github.com/rakshasa/libtorrent/pull/99/files + +--- src/protocol/extensions.cc.orig 2015-08-08 17:01:32.000000000 +0200 ++++ src/protocol/extensions.cc 2017-12-02 01:46:38.522736000 +0100 +@@ -394,7 +394,7 @@ + if (m_download->info()->is_meta_download() || piece >= pieceEnd) { + // reject: { "msg_type" => 2, "piece" => ... } + m_pendingType = UT_METADATA; +- m_pending = build_bencode(40, "d8:msg_typei2e5:piecei%zuee", piece); ++ m_pending = build_bencode(sizeof(size_t) + 36, "d8:msg_typei2e5:piecei%zuee", piece); + return; + } + +@@ -407,7 +407,7 @@ + // data: { "msg_type" => 1, "piece" => ..., "total_size" => ... } followed by piece data (outside of dictionary) + size_t length = piece == pieceEnd - 1 ? m_download->info()->metadata_size() % metadata_piece_size : metadata_piece_size; + m_pendingType = UT_METADATA; +- m_pending = build_bencode(length + 128, "d8:msg_typei1e5:piecei%zue10:total_sizei%zuee", piece, metadataSize); ++ m_pending = build_bencode((2 * sizeof(size_t)) + length + 120, "d8:msg_typei1e5:piecei%zue10:total_sizei%zuee", piece, metadataSize); + + memcpy(m_pending.end(), buffer + (piece << metadata_piece_shift), length); + m_pending.set(m_pending.data(), m_pending.end() + length, m_pending.owned()); +--- src/protocol/handshake.cc.orig 2015-08-08 17:01:49.000000000 +0200 ++++ src/protocol/handshake.cc 2017-12-02 01:46:38.523093000 +0100 +@@ -738,7 +738,7 @@ + break; + + if (m_readBuffer.remaining() > m_encryption.length_ia()) +- throw internal_error("Read past initial payload after incoming encrypted handshake."); ++ throw handshake_error(ConnectionManager::handshake_failed, e_handshake_invalid_value); + + if (m_encryption.crypto() != HandshakeEncryption::crypto_rc4) + m_encryption.info()->set_obfuscated(); +--- src/torrent/object_stream.cc.orig 2015-08-08 17:01:32.000000000 +0200 ++++ src/torrent/object_stream.cc 2017-12-02 01:46:38.523350000 +0100 +@@ -104,7 +104,8 @@ + while (first != last && *first >= '0' && *first <= '9') + length = length * 10 + (*first++ - '0'); + +- if (length + 1 > (unsigned int)std::distance(first, last) || *first++ != ':') ++ if (length + 1 > (unsigned int)std::distance(first, last) || *first++ != ':' ++ || length + 1 == 0) + throw torrent::bencode_error("Invalid bencode data."); + + return raw_string(first, length);