luc14n0/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2025-01-27 14:36:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

ghostutils: Abandon hostname conversion early if it’s too long

Browse Source 
The `nameprep()` function in `ghostutils.c` is quite complex, and does a
lot of allocations. This means it can take a long time on long hostnames
(on the order of 10KB long). Hostnames should never be that long,
though, so impose some loose length limits.

oss-fuzz#27371

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>
This commit is contained in:
Philip Withnall 2020-12-04 13:18:37 +00:00
parent 3531239f0e
commit 1d461bc9f4
2 changed files with 96 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
glib/ghostutils.c
View File

@ -21,6 +21,10 @@
#include <string.h>
#ifdef G_OS_UNIX
#include <unistd.h>
#endif
#include "ghostutils.h"
#include "garray.h"
@ -29,6 +33,10 @@
#include "gstrfuncs.h"
#include "glibintl.h"
#ifdef G_PLATFORM_WIN32
#include <windows.h>
#endif
/**
* SECTION:ghostutils
@ -405,6 +413,45 @@ idna_end_of_label (const gchar *str)
return str;
}
static gsize
get_hostname_max_length_bytes (void)
{
#if defined(G_OS_WIN32)
wchar_t tmp[MAX_COMPUTERNAME_LENGTH];
return sizeof (tmp) / sizeof (tmp[0]);
#elif defined(_SC_HOST_NAME_MAX)
glong max = sysconf (_SC_HOST_NAME_MAX);
if (max > 0)
return (gsize) max;
#ifdef HOST_NAME_MAX
return HOST_NAME_MAX;
#else
return _POSIX_HOST_NAME_MAX;
#endif /* HOST_NAME_MAX */
#else
/* Fallback to some reasonable value
* See https://stackoverflow.com/questions/8724954/what-is-the-maximum-number-of-characters-for-a-host-name-in-unix/28918017#28918017 */
return 255;
#endif
}
/* Returns %TRUE if `strlen (str) > comparison_length`, but without actually
* running `strlen(str)`, as that would take a very long time for long
* (untrusted) input strings. */
static gboolean
strlen_greater_than (const gchar *str,
gsize comparison_length)
{
gsize i;
for (i = 0; str[i] != '\0'; i++)
if (i > comparison_length)
return TRUE;
return FALSE;
}
/**
* g_hostname_to_ascii:
* @hostname: a valid UTF-8 or ASCII hostname
@ -425,6 +472,32 @@ g_hostname_to_ascii (const gchar *hostname)
GString *out;
gssize llen, oldlen;
gboolean unicode;
gsize hostname_max_length_bytes = get_hostname_max_length_bytes ();
/* Do an initial check on the hostname length, as overlong hostnames take a
* long time in the IDN cleanup algorithm in nameprep(). The ultimate
* restriction is that the IDN-decoded (i.e. pure ASCII) hostname cannot be
* longer than 255 bytes. That’s the least restrictive limit on hostname
* length of all the ways hostnames can be interpreted. Typically, the
* hostname will be an FQDN, which is limited to 253 bytes long. POSIX
* hostnames are limited to `get_hostname_max_length_bytes()` (typically 255
* bytes).
*
* See https://stackoverflow.com/a/28918017/2931197
*
* It’s possible for a hostname to be %-encoded, in which case its decoded
* length will be as much as 3× shorter.
*
* It’s also possible for a hostname to use overlong UTF-8 encodings, in which
* case its decoded length will be as much as 4× shorter.
*
* Note: This check is not intended as an absolute guarantee that a hostname
* is the right length and will be accepted by other systems. It’s intended to
* stop wildly-invalid hostnames from taking forever in nameprep().
*/
if (hostname_max_length_bytes <= G_MAXSIZE / 4 &&
strlen_greater_than (hostname, 4 * MAX (255, hostname_max_length_bytes)))
return NULL;
label = name = nameprep (hostname, -1, &unicode);
if (!name || !unicode)
@ -604,6 +677,12 @@ g_hostname_to_unicode (const gchar *hostname)
{
GString *out;
gssize llen;
gsize hostname_max_length_bytes = get_hostname_max_length_bytes ();
/* See the comment at the top of g_hostname_to_ascii(). */
if (hostname_max_length_bytes <= G_MAXSIZE / 4 &&
strlen_greater_than (hostname, 4 * MAX (255, hostname_max_length_bytes)))
return NULL;
out = g_string_new (NULL);

18
glib/tests/hostutils.c
View File

@ -69,7 +69,23 @@ static const gint num_non_round_trip_names = G_N_ELEMENTS (non_round_trip_names)
static const gchar *bad_names[] = {
"disallowed\xef\xbf\xbd" "character",
"non-utf\x88",
"xn--mixed-\xc3\xbcp"
"xn--mixed-\xc3\xbcp",
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong"
"verylongverylongverylongverylongverylongverylongverylongverylongverylong",
};
static const gint num_bad_names = G_N_ELEMENTS (bad_names);