Date: Thu, 30 Jan 2025 20:33:30 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 284472] bspatch(1): still one "attack vector" Message-ID: <bug-284472-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D284472 Bug ID: 284472 Summary: bspatch(1): still one "attack vector" Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: bin Assignee: bugs@FreeBSD.org Reporter: steffen@sdaoden.eu i had shared the following in private already, but since the code has not b= een fixed i simply create a bug report. <code> |The problem is that at the end of the loop there is a | | /* Adjust pointers */ | - newpos+=3Dctrl[1]; | - oldpos+=3Dctrl[2]; | + newpos =3D add_off_t(newpos, ctrl[1]); | + oldpos =3D add_off_t(oldpos, ctrl[2]); | |but before that we have | | /* Add old data to diff string */ | for (i =3D 0; i < ctrl[0]; i++) | - if ((oldpos + i >=3D 0) && (oldpos + i < oldsiz= e)) | + if (add_off_t(oldpos, i) < oldsize) | new[newpos + i] +=3D old[oldpos + i]; | |of if ctrl[2] is only "negative enough" then in the next loop tick |old will be accessed at a negative offset, i would think. </code> (I think analysis was right.) btw i have created a "bsdipa" fork which is, i think, an iterated variant of bsdiff/bspatch: <code> s-bsdipa (ZLIB; 0.5.3): create or apply binary difference patch s-bsdipa [!]patch after patch restored s-bsdipa [!]diff before after patch s-bsdipa [!]xdiff before after patch s-bsdipa [!]diff/VAL before after patch The first uses "patch" to create "restored" from "after". The latter create "patch" from the difference of "after" and "before"; they differ in the size of the "magic window": diff uses the built-in value, xdiff uses 16, whereas diff/VAL expects a positive integer to be used inste= ad. An existing target is overwritten if the subcommand is prefixed with "!". Some statistics are written on standard output. . Patches use ZLIB compression. </code> Adding a zstd variant would be easy. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-284472-227>