pool/qemu
SHA256
5
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Accepting request 785936 from home:bfrogers:branches:Virtualization

Browse Source 
- Fix potential OOB accesses in slirp (CVE-2020-8608 bsc#1163018
  bsc#1161066 CVE-2020-7039)
  slirp-use-correct-size-while-emulating-c.patch
  slirp-use-correct-size-while-emulating-I.patch
  tcp_emu-Fix-oob-access.patch
  tcp_emu-fix-unsafe-snprintf-usages.patch
  util-add-slirp_fmt-helpers.patch
- Replace this patch with upstream version
  target-arm-monitor-query-cpu-model-expan.patch

OBS-URL: https://build.opensuse.org/request/show/785936
OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=536
This commit is contained in:
Bruce Rogers 2020-03-17 13:47:06 +00:00 committed by Git OBS Bridge
parent a4acc2776c
commit 38b478cbe9
9 changed files with 498 additions and 59 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bundles.tar.xz
View File

@ -1,3 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:e4135bcee5cdc6889a49bd0f162dc9eb258528d48bc9dedd458430e174aa8530
size 92732
oid sha256:596a134fe14bb9bca1c177f682098f030ae5741767b562413a0212570aa863e1
size 95812

13
qemu.changes
View File

@ -1,3 +1,16 @@
-------------------------------------------------------------------
Mon Mar 16 19:58:35 UTC 2020 - Bruce Rogers <brogers@suse.com>
- Fix potential OOB accesses in slirp (CVE-2020-8608 bsc#1163018
bsc#1161066 CVE-2020-7039)
slirp-use-correct-size-while-emulating-c.patch
slirp-use-correct-size-while-emulating-I.patch
tcp_emu-Fix-oob-access.patch
tcp_emu-fix-unsafe-snprintf-usages.patch
util-add-slirp_fmt-helpers.patch
- Replace this patch with upstream version
target-arm-monitor-query-cpu-model-expan.patch
-------------------------------------------------------------------
Thu Mar 12 16:27:03 UTC 2020 - Bruce Rogers <brogers@suse.com>

121
qemu.spec
View File

@ -188,61 +188,61 @@ Patch00057: block-fix-memleaks-in-bdrv_refresh_filen.patch
Patch00058: block-backup-top-fix-failure-path.patch
Patch00059: iotests-add-test-for-backup-top-failure-.patch
Patch00060: audio-oss-fix-buffer-pos-calculation.patch
Patch00061: block-fix-crash-on-zero-length-unaligned.patch
Patch00062: block-Fix-VM-size-field-width-in-snapsho.patch
Patch00063: target-arm-Correct-definition-of-PMCRDP.patch
Patch00064: block-nbd-extract-the-common-cleanup-cod.patch
Patch00065: block-nbd-fix-memory-leak-in-nbd_open.patch
Patch00066: virtio-crypto-do-delete-ctrl_vq-in-virti.patch
Patch00067: virtio-pmem-do-delete-rq_vq-in-virtio_pm.patch
Patch00068: vhost-user-blk-delete-virtioqueues-in-un.patch
Patch00069: hw-arm-cubieboard-use-ARM-Cortex-A8-as-t.patch
Patch00070: iotests-Fix-nonportable-use-of-od-endian.patch
Patch00071: block-qcow2-threads-fix-qcow2_decompress.patch
Patch00072: job-refactor-progress-to-separate-object.patch
Patch00073: block-block-copy-fix-progress-calculatio.patch
Patch00074: XXX-dont-dump-core-on-sigabort.patch
Patch00075: qemu-binfmt-conf-Modify-default-path.patch
Patch00076: qemu-cvs-gettimeofday.patch
Patch00077: qemu-cvs-ioctl_debug.patch
Patch00078: qemu-cvs-ioctl_nodirection.patch
Patch00079: linux-user-add-binfmt-wrapper-for-argv-0.patch
Patch00080: PPC-KVM-Disable-mmu-notifier-check.patch
Patch00081: linux-user-binfmt-support-host-binaries.patch
Patch00082: linux-user-Fake-proc-cpuinfo.patch
Patch00083: linux-user-use-target_ulong.patch
Patch00084: Make-char-muxer-more-robust-wrt-small-FI.patch
Patch00085: linux-user-lseek-explicitly-cast-non-set.patch
Patch00086: AIO-Reduce-number-of-threads-for-32bit-h.patch
Patch00087: xen_disk-Add-suse-specific-flush-disable.patch
Patch00088: qemu-bridge-helper-reduce-security-profi.patch
Patch00089: qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch
Patch00090: linux-user-properly-test-for-infinite-ti.patch
Patch00091: roms-Makefile-pass-a-packaging-timestamp.patch
Patch00092: Raise-soft-address-space-limit-to-hard-l.patch
Patch00093: increase-x86_64-physical-bits-to-42.patch
Patch00094: vga-Raise-VRAM-to-16-MiB-for-pc-0.15-and.patch
Patch00095: i8254-Fix-migration-from-SLE11-SP2.patch
Patch00096: acpi_piix4-Fix-migration-from-SLE11-SP2.patch
Patch00097: Switch-order-of-libraries-for-mpath-supp.patch
Patch00098: Make-installed-scripts-explicitly-python.patch
Patch00099: hw-smbios-handle-both-file-formats-regar.patch
Patch00100: xen-add-block-resize-support-for-xen-dis.patch
Patch00101: tests-qemu-iotests-Triple-timeout-of-i-o.patch
Patch00102: tests-Fix-block-tests-to-be-compatible-w.patch
Patch00103: xen-ignore-live-parameter-from-xen-save-.patch
Patch00104: Conditionalize-ui-bitmap-installation-be.patch
Patch00105: tests-change-error-message-in-test-162.patch
Patch00106: hw-usb-hcd-xhci-Fix-GCC-9-build-warning.patch
Patch00107: hw-usb-dev-mtp-Fix-GCC-9-build-warning.patch
Patch00108: hw-intc-exynos4210_gic-provide-more-room.patch
Patch00109: configure-only-populate-roms-if-softmmu.patch
Patch00110: pc-bios-s390-ccw-net-avoid-warning-about.patch
Patch00111: roms-change-cross-compiler-naming-to-be-.patch
Patch00112: tests-Disable-some-block-tests-for-now.patch
Patch00113: test-add-mapping-from-arch-of-i686-to-qe.patch
Patch00114: roms-Makefile-enable-cross-compile-for-b.patch
Patch00115: target-arm-monitor-query-cpu-model-expan.patch
Patch00061: target-arm-monitor-query-cpu-model-expan.patch
Patch00062: block-fix-crash-on-zero-length-unaligned.patch
Patch00063: block-Fix-VM-size-field-width-in-snapsho.patch
Patch00064: target-arm-Correct-definition-of-PMCRDP.patch
Patch00065: block-nbd-extract-the-common-cleanup-cod.patch
Patch00066: block-nbd-fix-memory-leak-in-nbd_open.patch
Patch00067: virtio-crypto-do-delete-ctrl_vq-in-virti.patch
Patch00068: virtio-pmem-do-delete-rq_vq-in-virtio_pm.patch
Patch00069: vhost-user-blk-delete-virtioqueues-in-un.patch
Patch00070: hw-arm-cubieboard-use-ARM-Cortex-A8-as-t.patch
Patch00071: iotests-Fix-nonportable-use-of-od-endian.patch
Patch00072: block-qcow2-threads-fix-qcow2_decompress.patch
Patch00073: job-refactor-progress-to-separate-object.patch
Patch00074: block-block-copy-fix-progress-calculatio.patch
Patch00075: XXX-dont-dump-core-on-sigabort.patch
Patch00076: qemu-binfmt-conf-Modify-default-path.patch
Patch00077: qemu-cvs-gettimeofday.patch
Patch00078: qemu-cvs-ioctl_debug.patch
Patch00079: qemu-cvs-ioctl_nodirection.patch
Patch00080: linux-user-add-binfmt-wrapper-for-argv-0.patch
Patch00081: PPC-KVM-Disable-mmu-notifier-check.patch
Patch00082: linux-user-binfmt-support-host-binaries.patch
Patch00083: linux-user-Fake-proc-cpuinfo.patch
Patch00084: linux-user-use-target_ulong.patch
Patch00085: Make-char-muxer-more-robust-wrt-small-FI.patch
Patch00086: linux-user-lseek-explicitly-cast-non-set.patch
Patch00087: AIO-Reduce-number-of-threads-for-32bit-h.patch
Patch00088: xen_disk-Add-suse-specific-flush-disable.patch
Patch00089: qemu-bridge-helper-reduce-security-profi.patch
Patch00090: qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch
Patch00091: linux-user-properly-test-for-infinite-ti.patch
Patch00092: roms-Makefile-pass-a-packaging-timestamp.patch
Patch00093: Raise-soft-address-space-limit-to-hard-l.patch
Patch00094: increase-x86_64-physical-bits-to-42.patch
Patch00095: vga-Raise-VRAM-to-16-MiB-for-pc-0.15-and.patch
Patch00096: i8254-Fix-migration-from-SLE11-SP2.patch
Patch00097: acpi_piix4-Fix-migration-from-SLE11-SP2.patch
Patch00098: Switch-order-of-libraries-for-mpath-supp.patch
Patch00099: Make-installed-scripts-explicitly-python.patch
Patch00100: hw-smbios-handle-both-file-formats-regar.patch
Patch00101: xen-add-block-resize-support-for-xen-dis.patch
Patch00102: tests-qemu-iotests-Triple-timeout-of-i-o.patch
Patch00103: tests-Fix-block-tests-to-be-compatible-w.patch
Patch00104: xen-ignore-live-parameter-from-xen-save-.patch
Patch00105: Conditionalize-ui-bitmap-installation-be.patch
Patch00106: tests-change-error-message-in-test-162.patch
Patch00107: hw-usb-hcd-xhci-Fix-GCC-9-build-warning.patch
Patch00108: hw-usb-dev-mtp-Fix-GCC-9-build-warning.patch
Patch00109: hw-intc-exynos4210_gic-provide-more-room.patch
Patch00110: configure-only-populate-roms-if-softmmu.patch
Patch00111: pc-bios-s390-ccw-net-avoid-warning-about.patch
Patch00112: roms-change-cross-compiler-naming-to-be-.patch
Patch00113: tests-Disable-some-block-tests-for-now.patch
Patch00114: test-add-mapping-from-arch-of-i686-to-qe.patch
Patch00115: roms-Makefile-enable-cross-compile-for-b.patch
Patch00116: hw-i386-disable-smbus-migration-for-xenf.patch
# Patches applied in roms/seabios/:
Patch01000: seabios-use-python2-explicitly-as-needed.patch
@ -259,6 +259,12 @@ Patch03000: sgabios-Makefile-fix-issues-of-build-rep.patch
Patch03001: roms-sgabios-Fix-csum8-to-be-built-by-ho.patch
# Patches applied in ui/keycodemapdb/:
Patch08000: Make-keycode-gen-output-reproducible-use.patch
# Patches applied in slirp/:
Patch09000: util-add-slirp_fmt-helpers.patch
Patch09001: slirp-use-correct-size-while-emulating-I.patch
Patch09002: tcp_emu-Fix-oob-access.patch
Patch09003: slirp-use-correct-size-while-emulating-c.patch
Patch09004: tcp_emu-fix-unsafe-snprintf-usages.patch
# Patches applied in roms/qboot/:
Patch12000: ensure-headers-included-are-compatible-w.patch
Patch12001: Enable-cross-compile-prefix-for-C-compil.patch
@ -1085,6 +1091,11 @@ This package provides a service file for starting and stopping KSM.
%patch03000 -p1
%patch03001 -p1
%patch08000 -p1
%patch09000 -p1
%patch09001 -p1
%patch09002 -p1
%patch09003 -p1
%patch09004 -p1
%patch12000 -p1
%patch12001 -p1

58
slirp-use-correct-size-while-emulating-I.patch Normal file
View File

@ -0,0 +1,58 @@
From: Prasad J Pandit <pjp@fedoraproject.org>
Date: Thu, 9 Jan 2020 15:12:27 +0530
Subject: slirp: use correct size while emulating IRC commands
Git-commit: ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9
References: bsc#1163018, CVE-2020-8608
While emulating IRC DCC commands, tcp_emu() uses 'mbuf' size
'm->m_size' to write DCC commands via snprintf(3). This may
lead to OOB write access, because 'bptr' points somewhere in
the middle of 'mbuf' buffer, not at the start. Use M_FREEROOM(m)
size to avoid OOB access.
Reported-by: Vishnu Dev TJ <vishnudevtj@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Message-Id: <20200109094228.79764-2-ppandit@redhat.com>
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
src/tcp_subr.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
index d6dd133a9f7082dbc6fafdfa7e01..6cd181c9f2875528adab3f636aec 100644
--- a/slirp/src/tcp_subr.c
+++ b/slirp/src/tcp_subr.c
@@ -778,7 +778,8 @@ int tcp_emu(struct socket *so, struct mbuf *m)
return 1;
}
m->m_len = bptr - m->m_data; /* Adjust length */
- m->m_len += snprintf(bptr, m->m_size, "DCC CHAT chat %lu %u%c\n",
+ m->m_len += snprintf(bptr, M_FREEROOM(m),
+ "DCC CHAT chat %lu %u%c\n",
(unsigned long)ntohl(so->so_faddr.s_addr),
ntohs(so->so_fport), 1);
} else if (sscanf(bptr, "DCC SEND %256s %u %u %u", buff, &laddr, &lport,
@@ -788,8 +789,8 @@ int tcp_emu(struct socket *so, struct mbuf *m)
return 1;
}
m->m_len = bptr - m->m_data; /* Adjust length */
- m->m_len +=
- snprintf(bptr, m->m_size, "DCC SEND %s %lu %u %u%c\n", buff,
+ m->m_len += snprintf(bptr, M_FREEROOM(m),
+ "DCC SEND %s %lu %u %u%c\n", buff,
(unsigned long)ntohl(so->so_faddr.s_addr),
ntohs(so->so_fport), n1, 1);
} else if (sscanf(bptr, "DCC MOVE %256s %u %u %u", buff, &laddr, &lport,
@@ -799,8 +800,8 @@ int tcp_emu(struct socket *so, struct mbuf *m)
return 1;
}
m->m_len = bptr - m->m_data; /* Adjust length */
- m->m_len +=
- snprintf(bptr, m->m_size, "DCC MOVE %s %lu %u %u%c\n", buff,
+ m->m_len += snprintf(bptr, M_FREEROOM(m),
+ "DCC MOVE %s %lu %u %u%c\n", buff,
(unsigned long)ntohl(so->so_faddr.s_addr),
ntohs(so->so_fport), n1, 1);
}

53
slirp-use-correct-size-while-emulating-c.patch Normal file
View File

@ -0,0 +1,53 @@
From: Prasad J Pandit <pjp@fedoraproject.org>
Date: Thu, 9 Jan 2020 15:12:28 +0530
Subject: slirp: use correct size while emulating commands
Git-commit: 82ebe9c370a0e2970fb5695aa19aa5214a6a1c80
References: bsc#1161066, CVE2020-7039, bsc#1163018, CVE-2020-8608
While emulating services in tcp_emu(), it uses 'mbuf' size
'm->m_size' to write commands via snprintf(3). Use M_FREEROOM(m)
size to avoid possible OOB access.
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Message-Id: <20200109094228.79764-3-ppandit@redhat.com>
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
src/tcp_subr.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
index cedbfb28686604dbb7e8e5b35dd1..954d1a6f5e6292b585638a8c0558 100644
--- a/slirp/src/tcp_subr.c
+++ b/slirp/src/tcp_subr.c
@@ -696,7 +696,7 @@ int tcp_emu(struct socket *so, struct mbuf *m)
n4 = (laddr & 0xff);
m->m_len = bptr - m->m_data; /* Adjust length */
- m->m_len += snprintf(bptr, m->m_size - m->m_len,
+ m->m_len += snprintf(bptr, M_FREEROOM(m),
"ORT %d,%d,%d,%d,%d,%d\r\n%s", n1, n2, n3, n4,
n5, n6, x == 7 ? buff : "");
return 1;
@@ -731,8 +731,7 @@ int tcp_emu(struct socket *so, struct mbuf *m)
n4 = (laddr & 0xff);
m->m_len = bptr - m->m_data; /* Adjust length */
- m->m_len +=
- snprintf(bptr, m->m_size - m->m_len,
+ m->m_len += snprintf(bptr, M_FREEROOM(m),
"27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
n1, n2, n3, n4, n5, n6, x == 7 ? buff : "");
@@ -758,8 +757,8 @@ int tcp_emu(struct socket *so, struct mbuf *m)
if (m->m_data[m->m_len - 1] == '\0' && lport != 0 &&
(so = tcp_listen(slirp, INADDR_ANY, 0, so->so_laddr.s_addr,
htons(lport), SS_FACCEPTONCE)) != NULL)
- m->m_len =
- snprintf(m->m_data, m->m_size, "%d", ntohs(so->so_fport)) + 1;
+ m->m_len = snprintf(m->m_data, M_ROOM(m),
+ "%d", ntohs(so->so_fport)) + 1;
return 1;
case EMU_IRC:

9
target-arm-monitor-query-cpu-model-expan.patch
View File

@ -1,8 +1,9 @@
From: Liang Yan <lyan@suse.com>
Date: Fri, 31 Jan 2020 14:54:06 -0500
Date: Fri, 7 Feb 2020 14:04:21 +0000
Subject: target/arm/monitor: query-cpu-model-expansion crashed qemu when using
machine type none
Git-commit: 0999a4ba8718aa96105b978d3567fc7e90244c7e
References: bsc#1159443
Commit e19afd566781 mentioned that target-arm only supports queryable
@ -15,8 +16,12 @@ So We add a check above it.
This won't affect i386 and s390x since they do not use current_cpu.
[LY: patch only queued in upstream, will update commit id later]
Signed-off-by: Liang Yan <lyan@suse.com>
Message-id: 20200203134251.12986-1-lyan@suse.com
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
target/arm/monitor.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)

40
tcp_emu-Fix-oob-access.patch Normal file
View File

@ -0,0 +1,40 @@
From: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date: Wed, 8 Jan 2020 00:58:48 +0100
Subject: tcp_emu: Fix oob access
Git-commit: 2655fffed7a9e765bcb4701dd876e9dab975f289
References: bsc#1161066, CVE2020-7039, bsc#1161066, CVS-2020-7039
The main loop only checks for one available byte, while we sometimes
need two bytes.
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
src/tcp_subr.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
index 6cd181c9f2875528adab3f636aec..cedbfb28686604dbb7e8e5b35dd1 100644
--- a/slirp/src/tcp_subr.c
+++ b/slirp/src/tcp_subr.c
@@ -887,6 +887,9 @@ int tcp_emu(struct socket *so, struct mbuf *m)
break;
case 5:
+ if (bptr == m->m_data + m->m_len - 1)
+ return 1; /* We need two bytes */
+
/*
* The difference between versions 1.0 and
* 2.0 is here. For future versions of
@@ -902,6 +905,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
/* This is the field containing the port
* number that RA-player is listening to.
*/
+
+ if (bptr == m->m_data + m->m_len - 1)
+ return 1; /* We need two bytes */
+
lport = (((uint8_t *)bptr)[0] << 8) + ((uint8_t *)bptr)[1];
if (lport < 6970)
lport += 256; /* don't know why */

134
tcp_emu-fix-unsafe-snprintf-usages.patch Normal file
View File

@ -0,0 +1,134 @@
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 27 Jan 2020 10:24:14 +0100
Subject: tcp_emu: fix unsafe snprintf() usages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Git-commit: 68ccb8021a838066f0951d4b2817eb6b6f10a843
References: bsc#1163018, CVE-2020-8608
Various calls to snprintf() assume that snprintf() returns "only" the
number of bytes written (excluding terminating NUL).
https://pubs.opengroup.org/onlinepubs/9699919799/functions/snprintf.html#tag_16_159_04
"Upon successful completion, the snprintf() function shall return the
number of bytes that would be written to s had n been sufficiently
large excluding the terminating null byte."
Before patch ce131029, if there isn't enough room in "m_data" for the
"DCC ..." message, we overflow "m_data".
After the patch, if there isn't enough room for the same, we don't
overflow "m_data", but we set "m_len" out-of-bounds. The next time an
access is bounded by "m_len", we'll have a buffer overflow then.
Use slirp_fmt*() to fix potential OOB memory access.
Reported-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Message-Id: <20200127092414.169796-7-marcandre.lureau@redhat.com>
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
src/tcp_subr.c | 44 +++++++++++++++++++++-----------------------
1 file changed, 21 insertions(+), 23 deletions(-)
diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
index 954d1a6f5e6292b585638a8c0558..26d4ead543a5357577817b39a3d6 100644
--- a/slirp/src/tcp_subr.c
+++ b/slirp/src/tcp_subr.c
@@ -655,8 +655,7 @@ int tcp_emu(struct socket *so, struct mbuf *m)
NTOHS(n1);
NTOHS(n2);
m_inc(m, snprintf(NULL, 0, "%d,%d\r\n", n1, n2) + 1);
- m->m_len = snprintf(m->m_data, M_ROOM(m), "%d,%d\r\n", n1, n2);
- assert(m->m_len < M_ROOM(m));
+ m->m_len = slirp_fmt(m->m_data, M_ROOM(m), "%d,%d\r\n", n1, n2);
} else {
*eol = '\r';
}
@@ -696,9 +695,9 @@ int tcp_emu(struct socket *so, struct mbuf *m)
n4 = (laddr & 0xff);
m->m_len = bptr - m->m_data; /* Adjust length */
- m->m_len += snprintf(bptr, M_FREEROOM(m),
- "ORT %d,%d,%d,%d,%d,%d\r\n%s", n1, n2, n3, n4,
- n5, n6, x == 7 ? buff : "");
+ m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
+ "ORT %d,%d,%d,%d,%d,%d\r\n%s",
+ n1, n2, n3, n4, n5, n6, x == 7 ? buff : "");
return 1;
} else if ((bptr = (char *)strstr(m->m_data, "27 Entering")) != NULL) {
/*
@@ -731,10 +730,9 @@ int tcp_emu(struct socket *so, struct mbuf *m)
n4 = (laddr & 0xff);
m->m_len = bptr - m->m_data; /* Adjust length */
- m->m_len += snprintf(bptr, M_FREEROOM(m),
- "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
- n1, n2, n3, n4, n5, n6, x == 7 ? buff : "");
-
+ m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
+ "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
+ n1, n2, n3, n4, n5, n6, x == 7 ? buff : "");
return 1;
}
@@ -757,8 +755,8 @@ int tcp_emu(struct socket *so, struct mbuf *m)
if (m->m_data[m->m_len - 1] == '\0' && lport != 0 &&
(so = tcp_listen(slirp, INADDR_ANY, 0, so->so_laddr.s_addr,
htons(lport), SS_FACCEPTONCE)) != NULL)
- m->m_len = snprintf(m->m_data, M_ROOM(m),
- "%d", ntohs(so->so_fport)) + 1;
+ m->m_len = slirp_fmt0(m->m_data, M_ROOM(m),
+ "%d", ntohs(so->so_fport));
return 1;
case EMU_IRC:
@@ -777,10 +775,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
return 1;
}
m->m_len = bptr - m->m_data; /* Adjust length */
- m->m_len += snprintf(bptr, M_FREEROOM(m),
- "DCC CHAT chat %lu %u%c\n",
- (unsigned long)ntohl(so->so_faddr.s_addr),
- ntohs(so->so_fport), 1);
+ m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
+ "DCC CHAT chat %lu %u%c\n",
+ (unsigned long)ntohl(so->so_faddr.s_addr),
+ ntohs(so->so_fport), 1);
} else if (sscanf(bptr, "DCC SEND %256s %u %u %u", buff, &laddr, &lport,
&n1) == 4) {
if ((so = tcp_listen(slirp, INADDR_ANY, 0, htonl(laddr),
@@ -788,10 +786,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
return 1;
}
m->m_len = bptr - m->m_data; /* Adjust length */
- m->m_len += snprintf(bptr, M_FREEROOM(m),
- "DCC SEND %s %lu %u %u%c\n", buff,
- (unsigned long)ntohl(so->so_faddr.s_addr),
- ntohs(so->so_fport), n1, 1);
+ m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
+ "DCC SEND %s %lu %u %u%c\n", buff,
+ (unsigned long)ntohl(so->so_faddr.s_addr),
+ ntohs(so->so_fport), n1, 1);
} else if (sscanf(bptr, "DCC MOVE %256s %u %u %u", buff, &laddr, &lport,
&n1) == 4) {
if ((so = tcp_listen(slirp, INADDR_ANY, 0, htonl(laddr),
@@ -799,10 +797,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
return 1;
}
m->m_len = bptr - m->m_data; /* Adjust length */
- m->m_len += snprintf(bptr, M_FREEROOM(m),
- "DCC MOVE %s %lu %u %u%c\n", buff,
- (unsigned long)ntohl(so->so_faddr.s_addr),
- ntohs(so->so_fport), n1, 1);
+ m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
+ "DCC MOVE %s %lu %u %u%c\n", buff,
+ (unsigned long)ntohl(so->so_faddr.s_addr),
+ ntohs(so->so_fport), n1, 1);
}
return 1;

125
util-add-slirp_fmt-helpers.patch Normal file
View File

@ -0,0 +1,125 @@
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 27 Jan 2020 10:24:09 +0100
Subject: util: add slirp_fmt() helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Git-commit: 30648c03b27fb8d9611b723184216cd3174b6775
References: bsc#1163018, CVE-2020-8608
Various calls to snprintf() in libslirp assume that snprintf() returns
"only" the number of bytes written (excluding terminating NUL).
https://pubs.opengroup.org/onlinepubs/9699919799/functions/snprintf.html#tag_16_159_04
"Upon successful completion, the snprintf() function shall return the
number of bytes that would be written to s had n been sufficiently
large excluding the terminating null byte."
Introduce slirp_fmt() that handles several pathological cases the
way libslirp usually expect:
- treat error as fatal (instead of silently returning -1)
- fmt0() will always \0 end
- return the number of bytes actually written (instead of what would
have been written, which would usually result in OOB later), including
the ending \0 for fmt0()
- warn if truncation happened (instead of ignoring)
Other less common cases can still be handled with strcpy/snprintf() etc.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Message-Id: <20200127092414.169796-2-marcandre.lureau@redhat.com>
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
src/util.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
src/util.h | 3 +++
2 files changed, 65 insertions(+)
diff --git a/slirp/src/util.c b/slirp/src/util.c
index e5960871554e37ab67a640d2cd9b..e3b625717b0f5ef6e54756045a17 100644
--- a/slirp/src/util.c
+++ b/slirp/src/util.c
@@ -364,3 +364,65 @@ void slirp_pstrcpy(char *buf, int buf_size, const char *str)
}
*q = '\0';
}
+
+static int slirp_vsnprintf(char *str, size_t size,
+ const char *format, va_list args)
+{
+ int rv = vsnprintf(str, size, format, args);
+
+ if (rv < 0) {
+ g_error("vsnprintf() failed: %s", g_strerror(errno));
+ }
+
+ return rv;
+}
+
+/*
+ * A snprintf()-like function that:
+ * - returns the number of bytes written (excluding optional \0-ending)
+ * - dies on error
+ * - warn on truncation
+ */
+int slirp_fmt(char *str, size_t size, const char *format, ...)
+{
+ va_list args;
+ int rv;
+
+ va_start(args, format);
+ rv = slirp_vsnprintf(str, size, format, args);
+ va_end(args);
+
+ if (rv > size) {
+ g_critical("vsnprintf() truncation");
+ }
+
+ return MIN(rv, size);
+}
+
+/*
+ * A snprintf()-like function that:
+ * - always \0-end (unless size == 0)
+ * - returns the number of bytes actually written, including \0 ending
+ * - dies on error
+ * - warn on truncation
+ */
+int slirp_fmt0(char *str, size_t size, const char *format, ...)
+{
+ va_list args;
+ int rv;
+
+ va_start(args, format);
+ rv = slirp_vsnprintf(str, size, format, args);
+ va_end(args);
+
+ if (rv >= size) {
+ g_critical("vsnprintf() truncation");
+ if (size > 0)
+ str[size - 1] = '\0';
+ rv = size;
+ } else {
+ rv += 1; /* include \0 */
+ }
+
+ return rv;
+}
diff --git a/slirp/src/util.h b/slirp/src/util.h
index 3c6223cecd9d881ca1a3f2d37af2..0558dfc222ec7d7b43beb2d18161 100644
--- a/slirp/src/util.h
+++ b/slirp/src/util.h
@@ -177,4 +177,7 @@ static inline int slirp_socket_set_fast_reuse(int fd)
void slirp_pstrcpy(char *buf, int buf_size, const char *str);
+int slirp_fmt(char *str, size_t size, const char *format, ...);
+int slirp_fmt0(char *str, size_t size, const char *format, ...);
+
#endif