From nobody Tue Dec 21 22:52:00 2021 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 6E26E18F8447; Tue, 21 Dec 2021 22:52:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4JJWt861rBz3h3K; Tue, 21 Dec 2021 22:52:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id AEDAB125EF; Tue, 21 Dec 2021 22:52:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 1BLMq0Hu095535; Tue, 21 Dec 2021 22:52:00 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 1BLMq0Qw095534; Tue, 21 Dec 2021 22:52:00 GMT (envelope-from git) Date: Tue, 21 Dec 2021 22:52:00 GMT Message-Id: <202112212252.1BLMq0Qw095534@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Jessica Clarke Subject: git: 6d5297569e70 - main - libc: Fix "harmless" iconv one-byte overread List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jrtc27 X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 6d5297569e70eb71eeb7ae5278a165d4ffb50874 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1640127120; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+Letw7J+dyo2iUaypwgIve0/jMJJTqhaAnN0juGHhWU=; b=muJWt6k0Uf4VVgft8s5M6a0QAwj1jss4CeWY0t5nc483gOgl4YOU1dGMlS55u/Gl6D5/vp fqoaKLqCaEYqBF91FZEiuPSXC5D+PeDHqaBe5FQLY/sCpvBGa9uUjASLNAg36efnGwfAhz 9C40RTDamT454hvd7PjflIiEvV35DtbAZhN1jmWFvEBG3FTkaXXcspcpehMDm2YdvIwG8J PR/kL7Sqh4tqh2NLT2dCyuX6rhfZ2dJVmXW2f61kL+/7JWJGPq5trs53JehTTYyzBGpig3 Oi+W96UpdhYPgYdPcNoF+4xZGaqAkMRS/Ahmo44DXBR0eliXaxVRFioLMw91ww== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1640127120; a=rsa-sha256; cv=none; b=eYBlgiyGVpWx3Wj/1MpJy1i72WGdMbqbYf9KS24stEKNpNWSXQWmbEXbhrDgmsEq06BNtc 03aMDiiZrH/fEM8z0vtd5hzGjIiJwsupir9pwq4STDpp6wCCpX4gIEBwphu5x6bKm0avmu 8ffZ822NsHWebkUN4+LPMWRzjUJ9n0to3PEvwyGSWoqYOcDwUUpLMVrA+eaQP8m7Lx32am wwUWbKOVdHID5u3k7X/10/Sc+3XhwtKS5dRVF4wZTyp/81H5KJRvwD0w3abtZcg+rx5goS i9Sa0lwfs8hlvwJ2vZZI9YEsjSCgt36VVdj/X691a34ic7o7LFkmOT8ST3rGfg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by jrtc27: URL: https://cgit.FreeBSD.org/src/commit/?id=6d5297569e70eb71eeb7ae5278a165d4ffb50874 commit 6d5297569e70eb71eeb7ae5278a165d4ffb50874 Author: Jessica Clarke AuthorDate: 2021-12-21 22:47:38 +0000 Commit: Jessica Clarke CommitDate: 2021-12-21 22:47:38 +0000 libc: Fix "harmless" iconv one-byte overread Checking there are still bytes left must be done before dereferencing the pointer, not the other way round. This is harmless on traditional architectures since the result will immediately be thrown away, and all callers are in separate translation units so there is no potential for optimising based on this out-of-bounds read. However, on CHERI, pointers are bounded, and so this will trap if fed a string that does not have a NUL within the first len bytes. Found by: CHERI Reviewed by: brooks --- lib/libc/iconv/citrus_bcs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/libc/iconv/citrus_bcs.c b/lib/libc/iconv/citrus_bcs.c index b8484a0d793e..cd88ea7fe2fd 100644 --- a/lib/libc/iconv/citrus_bcs.c +++ b/lib/libc/iconv/citrus_bcs.c @@ -109,7 +109,7 @@ const char * _citrus_bcs_skip_ws_len(const char * __restrict p, size_t * __restrict len) { - while (*p && *len > 0 && _bcs_isspace(*p)) { + while (*len > 0 && *p && _bcs_isspace(*p)) { p++; (*len)--; } @@ -124,7 +124,7 @@ const char * _citrus_bcs_skip_nonws_len(const char * __restrict p, size_t * __restrict len) { - while (*p && *len > 0 && !_bcs_isspace(*p)) { + while (*len > 0 && *p && !_bcs_isspace(*p)) { p++; (*len)--; }