From nobody Mon Jul 29 14:02:55 2024 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WXg6l4qy0z5S3rw; Mon, 29 Jul 2024 14:02:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4WXg6l3f0wz4pjj; Mon, 29 Jul 2024 14:02:55 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1722261775; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+fj6bZx1eLT2qj6aYP8mxF0nIKGwJZHpVPxhZrycts8=; b=Nuf95bdZ4AVv822tYJmjeef+mfl2OjhvoSgC7cyJa4XdllgzDuq6oWBgWbU5wGEfk1fRep nJwRdPDROF613u9icCUbBsOslUaZlQYWE0mqpW54bu8nJo7yTYaDXJs1kfbFESOT3M6KvH v6dJlN+Yg6iYN40K/6djfk3dunFSP2r+ykpE6QXN1zUPxGF8S+sxdRYK2jfy+P9SFEqMwo yQQOKMnUzgvhM2Xwvz+1oBDhLXIry+zBSSkZD65UKEqf0WgNRzib5nclzPs9uRVQYkPSRM cKZZeaoD9cAbMZRD1hX8bDs2q++D4BycGdXexqyj7qzunxdcS+0MCDEoq3v13w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1722261775; a=rsa-sha256; cv=none; b=XInj017g4roR6oO/QASXWEN9Lb/BrzrTZjBiM2UL4yMwQ05LPpjWWaioHLka0OATG/pXS3 0SYxfLqfBaEbFy4aahitfYlryVz7EPLUsBM98lHykBtNxUgSLQnJnQ5VhQDmjRrAWKz9Pb PInfw3ox12nHl+PKeLLd/aOGe622PozfioDrXOt4zZLwS31ugTN5Z3OXztRwWm7uv2TT/Z OamIHNYsAqql7Oo40OUbCgMVybZqJlajpP4X2gyRoYaF0Gi11XZ2OFTc7d4GxHf8M53pkP /GpIlkik0ccYFKjZHtNXzCqow+eVfT5p23IwiIN7VXCKKPBUOu4Hd1k1l2u4qQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1722261775; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+fj6bZx1eLT2qj6aYP8mxF0nIKGwJZHpVPxhZrycts8=; b=lF2AtW2C6C/pMn0zxlvKshcDlY6BN3uU67dGXPV2JZFPyIc8EGPtYC/9lTJsuWMmJ+JhGt Yltv7kRJgLCNKAweeO2Tns+dO0TJ+/X2qiSITRFxiNDNNNV8ketpGatzsgjpY10YR4Ipka N1e8obpO/M/Um9XNUBZ/09LfsOc6NVBMcSiykH5xMIoFHIsWL24MIbDXauNNRYR4+wjgri Y9G85TUjchfYXp4U3CVjCdHtO83xIMk8dzFIEoHjEXdeB1GZ+rjC0kr+Wb9Wmlx5xDCwrS tg76P5xVntqqVYTLqD9dWIZJm54vLZCXyA4CxRaHE1UxlJeLNFRjOnKgLCVSJw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4WXg6l3G9Szd4d; Mon, 29 Jul 2024 14:02:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 46TE2tMZ049500; Mon, 29 Jul 2024 14:02:55 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 46TE2tOC049497; Mon, 29 Jul 2024 14:02:55 GMT (envelope-from git) Date: Mon, 29 Jul 2024 14:02:55 GMT Message-Id: <202407291402.46TE2tOC049497@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Dag-Erling =?utf-8?Q?Sm=C3=B8rgrav?= Subject: git: 9317242469f1 - main - diff: Fix integer overflow. List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: des X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 9317242469f1ca682626d9806f8caf65d143c09a Auto-Submitted: auto-generated The branch main has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=9317242469f1ca682626d9806f8caf65d143c09a commit 9317242469f1ca682626d9806f8caf65d143c09a Author: Dag-Erling Smørgrav AuthorDate: 2024-07-29 14:02:29 +0000 Commit: Dag-Erling Smørgrav CommitDate: 2024-07-29 14:02:29 +0000 diff: Fix integer overflow. The legacy Stone algorithm uses `int` to represent line numbers, array indices, and array lengths. If given inputs approaching `INT_MAX` lines, it would overflow and attempt to allocate ridiculously large amounts of memory. To avoid this without penalizing non-pathological inputs, switch a few variables to `size_t` and add checks while and immediately after reading both inputs. MFC after: 3 days PR: 280371 Sponsored by: Klara, Inc. Reviewed by: allanjude Differential Revision: https://reviews.freebsd.org/D46169 --- usr.bin/diff/diffreg.c | 45 ++++++++++++++++++++++++--------------------- 1 file changed, 24 insertions(+), 21 deletions(-) diff --git a/usr.bin/diff/diffreg.c b/usr.bin/diff/diffreg.c index 6073feebf5fb..ffa5568bf442 100644 --- a/usr.bin/diff/diffreg.c +++ b/usr.bin/diff/diffreg.c @@ -203,9 +203,9 @@ static int *klist; /* will be overlaid on file[0] after class */ static int *member; /* will be overlaid on file[1] */ static int clen; static int inifdef; /* whether or not we are in a #ifdef block */ -static int len[2]; -static int pref, suff; /* length of prefix and suffix */ -static int slen[2]; +static size_t len[2]; /* lengths of files in lines */ +static size_t pref, suff; /* lengths of prefix and suffix */ +static size_t slen[2]; /* lengths of files minus pref / suff */ static int anychange; static int hw, lpad,rpad; /* half width and padding */ static int edoffset; @@ -425,6 +425,10 @@ diffreg_stone(char *file1, char *file2, int flags, int capsicum) status |= 1; goto closem; } + if (len[0] > INT_MAX - 2) + errc(1, EFBIG, "%s", file1); + if (len[1] > INT_MAX - 2) + errc(1, EFBIG, "%s", file2); prune(); sort(sfile[0], slen[0]); @@ -550,18 +554,17 @@ prepare(int i, FILE *fd, size_t filesize, int flags) sz = 100; p = xcalloc(sz + 3, sizeof(*p)); - while ((r = readhash(fd, flags, &h)) != RH_EOF) - switch (r) { - case RH_EOF: /* otherwise clang complains */ - case RH_BINARY: + while ((r = readhash(fd, flags, &h)) != RH_EOF) { + if (r == RH_BINARY) return (false); - case RH_OK: - if (j == sz) { - sz = sz * 3 / 2; - p = xreallocarray(p, sz + 3, sizeof(*p)); - } - p[++j].value = h; + if (j == SIZE_MAX) + break; + if (j == sz) { + sz = sz * 3 / 2; + p = xreallocarray(p, sz + 3, sizeof(*p)); } + p[++j].value = h; + } len[i] = j; file[i] = p; @@ -572,7 +575,7 @@ prepare(int i, FILE *fd, size_t filesize, int flags) static void prune(void) { - int i, j; + size_t i, j; for (pref = 0; pref < len[0] && pref < len[1] && file[0][pref + 1].value == file[1][pref + 1].value; @@ -710,7 +713,7 @@ static void unravel(int p) { struct cand *q; - int i; + size_t i; for (i = 0; i <= len[0]; i++) J[i] = i <= pref ? i : @@ -737,7 +740,7 @@ check(FILE *f1, FILE *f2, int flags) ixold[0] = ixnew[0] = 0; /* jackpot = 0; */ ctold = ctnew = 0; - for (i = 1; i <= len[0]; i++) { + for (i = 1; i <= (int)len[0]; i++) { if (J[i] == 0) { ixold[i] = ctold += skipline(f1); continue; @@ -837,7 +840,7 @@ check(FILE *f1, FILE *f2, int flags) ixnew[j] = ctnew; j++; } - for (; j <= len[1]; j++) { + for (; j <= (int)len[1]; j++) { ixnew[j] = ctnew += skipline(f2); } /* @@ -1504,9 +1507,9 @@ dump_context_vec(FILE *f1, FILE *f2, int flags) b = d = 0; /* gcc */ lowa = MAX(1, cvp->a - diff_context); - upb = MIN(len[0], context_vec_ptr->b + diff_context); + upb = MIN((int)len[0], context_vec_ptr->b + diff_context); lowc = MAX(1, cvp->c - diff_context); - upd = MIN(len[1], context_vec_ptr->d + diff_context); + upd = MIN((int)len[1], context_vec_ptr->d + diff_context); printf("***************"); if (flags & (D_PROTOTYPE | D_MATCHLAST)) { @@ -1607,9 +1610,9 @@ dump_unified_vec(FILE *f1, FILE *f2, int flags) b = d = 0; /* gcc */ lowa = MAX(1, cvp->a - diff_context); - upb = MIN(len[0], context_vec_ptr->b + diff_context); + upb = MIN((int)len[0], context_vec_ptr->b + diff_context); lowc = MAX(1, cvp->c - diff_context); - upd = MIN(len[1], context_vec_ptr->d + diff_context); + upd = MIN((int)len[1], context_vec_ptr->d + diff_context); printf("@@ -"); uni_range(lowa, upb);