From nobody Thu Aug 01 16:16:53 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WZYxy2fChz5T0fR; Thu, 01 Aug 2024 16:16:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4WZYxy15PZz4gFY; Thu, 1 Aug 2024 16:16:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1722529014; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GguIuc8y9/UBYa+kXNalwtMz3IxrUWM4HGbbrm63sQ8=; b=I52+DjtdWjGG/XDIKCmhMDLi9sP1Mjplm/qg4S/nZnOWfZUmz36HSkUQIUn7w3mlG8Sxc6 Q+AtefAQnFoD+Xpb+utQ70pNW9m/l6jl0nN2fAZv4yiz5/XRM6ekDEk/bWYQopW9el7hXW 8ldcy/KgvDxSEgPMk1SAONtQOLy2yGpO/ThSSJpNY7KtWEvr9Np3yXGBG1tLA5UQRL8IW5 5rfxkSTzqUZmHm7rrpBBMYqG+/3t8A/T6thfGEwezJlV0ybSue3wGQBfG8PBzrZ3Rgy/gW czUaa7EOWER+Kcrk6KG86RMmSPvCPK117W8sLDLu5J/TmX8VO/njVzaoGKhxyQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1722529014; a=rsa-sha256; cv=none; b=ctiFhsIranvVzrfhmVmwLaFnEcrOQ0aSRIelR3wZYY6Dw9u8qfdsge0yzoLCvD9LZq0JYN e7JK/jnP6B7FiV1rOLnufGgTmN935wWODHwm6c+ZUcKci+ri+upR9TR1JN6xA+L9yIUkL4 i6i3QZoAQImJxNHqYPeDXGiSC/1tAnKXDZI3P8hIQa8bVBNvo9g+6tHSfQNK9ZRxL+WZ9b QItLRsp9gFLAgzquHhuNW32qiWtHdDtfTWMuvVqa2jQ/Ur17fyrVixpCTQg8wjBwt94Y9U GHoIfBZ8FYPlJHdpMZntu+e2B67Z8BFp03yHEKeYJbw08c0FeSjl4SWqtSbeYw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1722529014; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GguIuc8y9/UBYa+kXNalwtMz3IxrUWM4HGbbrm63sQ8=; b=ZhW9ccDz5e7GECOCXzDqVwAk8ZCwAXVOxWXLwtp2kI1vg7Bpnxvm6y0T+J3BOi3EaXUdxs c3AXn6PP3FBiS1kA2RsbyYbiEenfK3+Gf/5ImbUxZHxFy+vetASGeTCw7tN919B/HF6oE0 WuECOANjJ9K0mD0gAryxtiJRVY5HSp8ajWyWcx+bFJo4T/oG4QsOC5AClnqM2NwQFjeYnm +hlFeGvXQpYOb0qy7aehBKSmvm4Rb+WqPse0bCTQVslzD7f/rB+d9CaE4AHZswKzkdbF7h +hzZAywHtOiHUvWrdLeatxGRoOMrv3x0xLHNSoG8gKGclLPgJMLTbrLw7SI+QQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4WZYxy0Sv4zrs3; Thu, 1 Aug 2024 16:16:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 471GGrE3095874; Thu, 1 Aug 2024 16:16:53 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 471GGrOk095871; Thu, 1 Aug 2024 16:16:53 GMT (envelope-from git) Date: Thu, 1 Aug 2024 16:16:53 GMT Message-Id: <202408011616.471GGrOk095871@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Dag-Erling =?utf-8?Q?Sm=C3=B8rgrav?= Subject: git: ea68175b07e0 - stable/14 - diff: Fix integer overflow. List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: des X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: ea68175b07e0cd8e51249d2858749481352aa553 Auto-Submitted: auto-generated The branch stable/14 has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=ea68175b07e0cd8e51249d2858749481352aa553 commit ea68175b07e0cd8e51249d2858749481352aa553 Author: Dag-Erling Smørgrav AuthorDate: 2024-07-29 14:02:29 +0000 Commit: Dag-Erling Smørgrav CommitDate: 2024-08-01 16:15:57 +0000 diff: Fix integer overflow. The legacy Stone algorithm uses `int` to represent line numbers, array indices, and array lengths. If given inputs approaching `INT_MAX` lines, it would overflow and attempt to allocate ridiculously large amounts of memory. To avoid this without penalizing non-pathological inputs, switch a few variables to `size_t` and add checks while and immediately after reading both inputs. MFC after: 3 days PR: 280371 Sponsored by: Klara, Inc. Reviewed by: allanjude Differential Revision: https://reviews.freebsd.org/D46169 (cherry picked from commit 9317242469f1ca682626d9806f8caf65d143c09a) --- usr.bin/diff/diffreg.c | 45 ++++++++++++++++++++++++--------------------- 1 file changed, 24 insertions(+), 21 deletions(-) diff --git a/usr.bin/diff/diffreg.c b/usr.bin/diff/diffreg.c index ffb3f90beede..2635c95daf6e 100644 --- a/usr.bin/diff/diffreg.c +++ b/usr.bin/diff/diffreg.c @@ -204,9 +204,9 @@ static int *klist; /* will be overlaid on file[0] after class */ static int *member; /* will be overlaid on file[1] */ static int clen; static int inifdef; /* whether or not we are in a #ifdef block */ -static int len[2]; -static int pref, suff; /* length of prefix and suffix */ -static int slen[2]; +static size_t len[2]; /* lengths of files in lines */ +static size_t pref, suff; /* lengths of prefix and suffix */ +static size_t slen[2]; /* lengths of files minus pref / suff */ static int anychange; static int hw, lpad, rpad; /* half width and padding */ static int edoffset; @@ -400,6 +400,10 @@ diffreg(char *file1, char *file2, int flags, int capsicum) status |= 1; goto closem; } + if (len[0] > INT_MAX - 2) + errc(1, EFBIG, "%s", file1); + if (len[1] > INT_MAX - 2) + errc(1, EFBIG, "%s", file2); prune(); sort(sfile[0], slen[0]); @@ -525,18 +529,17 @@ prepare(int i, FILE *fd, size_t filesize, int flags) sz = 100; p = xcalloc(sz + 3, sizeof(*p)); - while ((r = readhash(fd, flags, &h)) != RH_EOF) - switch (r) { - case RH_EOF: /* otherwise clang complains */ - case RH_BINARY: + while ((r = readhash(fd, flags, &h)) != RH_EOF) { + if (r == RH_BINARY) return (false); - case RH_OK: - if (j == sz) { - sz = sz * 3 / 2; - p = xreallocarray(p, sz + 3, sizeof(*p)); - } - p[++j].value = h; + if (j == SIZE_MAX) + break; + if (j == sz) { + sz = sz * 3 / 2; + p = xreallocarray(p, sz + 3, sizeof(*p)); } + p[++j].value = h; + } len[i] = j; file[i] = p; @@ -547,7 +550,7 @@ prepare(int i, FILE *fd, size_t filesize, int flags) static void prune(void) { - int i, j; + size_t i, j; for (pref = 0; pref < len[0] && pref < len[1] && file[0][pref + 1].value == file[1][pref + 1].value; @@ -685,7 +688,7 @@ static void unravel(int p) { struct cand *q; - int i; + size_t i; for (i = 0; i <= len[0]; i++) J[i] = i <= pref ? i : @@ -712,7 +715,7 @@ check(FILE *f1, FILE *f2, int flags) ixold[0] = ixnew[0] = 0; /* jackpot = 0; */ ctold = ctnew = 0; - for (i = 1; i <= len[0]; i++) { + for (i = 1; i <= (int)len[0]; i++) { if (J[i] == 0) { ixold[i] = ctold += skipline(f1); continue; @@ -812,7 +815,7 @@ check(FILE *f1, FILE *f2, int flags) ixnew[j] = ctnew; j++; } - for (; j <= len[1]; j++) { + for (; j <= (int)len[1]; j++) { ixnew[j] = ctnew += skipline(f2); } /* @@ -1474,9 +1477,9 @@ dump_context_vec(FILE *f1, FILE *f2, int flags) b = d = 0; /* gcc */ lowa = MAX(1, cvp->a - diff_context); - upb = MIN(len[0], context_vec_ptr->b + diff_context); + upb = MIN((int)len[0], context_vec_ptr->b + diff_context); lowc = MAX(1, cvp->c - diff_context); - upd = MIN(len[1], context_vec_ptr->d + diff_context); + upd = MIN((int)len[1], context_vec_ptr->d + diff_context); printf("***************"); if (flags & (D_PROTOTYPE | D_MATCHLAST)) { @@ -1577,9 +1580,9 @@ dump_unified_vec(FILE *f1, FILE *f2, int flags) b = d = 0; /* gcc */ lowa = MAX(1, cvp->a - diff_context); - upb = MIN(len[0], context_vec_ptr->b + diff_context); + upb = MIN((int)len[0], context_vec_ptr->b + diff_context); lowc = MAX(1, cvp->c - diff_context); - upd = MIN(len[1], context_vec_ptr->d + diff_context); + upd = MIN((int)len[1], context_vec_ptr->d + diff_context); printf("@@ -"); uni_range(lowa, upb);