[PATCH] potential memory corruption in calls to gnutls function on 64 bit arch
Reported by teuf | July 24th, 2009 @ 07:22 PM | in 1.0 Release
Looking at lockdown.c:
/ if everything went well, export in PEM format /
gnutls_datum_t dev_pem = { NULL, 0 };
gnutls_x509_crt_export(dev_cert, GNUTLS_X509_FMT_PEM, NULL, &dev_pem.size);
dev_pem.data = gnutls_malloc(dev_pem.size);
gnutls_x509_crt_export(dev_cert, GNUTLS_X509_FMT_PEM, dev_pem.data, &dev_pem.size);
On my box, gnutls_datum_t is:
typedef struct
{
unsigned char *data;
unsigned int size;
and gnutls_x509_crt_export has this prototype:
} gnutls_datum_t;
int gnutls_x509_crt_export(gnutls_x509_crt_t cert,
gnutls_x509_crt_fmt_t format,
void *output_data,
size_t *output_data_size);</code>
ints are 4 bytes long on x86_64/linux, size_t is 8 bytes long, so when passing &dev_pem.size to gnutls_x509_crt_export, the 4 bytes after &dev_pem.size might be written to. In this case, these 4 bytes are padding in the gnutls_datum_t, but I wouldn't rely on that.
The same issue is present in userpref.c. gcc complains about it when compiling with -Wall -Werror.
Comments and changes to this ticket
-
Nikias Bassen July 28th, 2009 @ 01:02 PM
- Assigned user set to “Matt Colyer”
- Tag set to “64bit, gnutls, patch”
- State changed from “new” to “open”
- Milestone set to “1.0 Release”
- Title changed from “potential memory corruption in calls to gnutls function on 64 bit arch” to “[PATCH] potential memory corruption in calls to gnutls function on 64 bit arch”
The attached patch should fix the issue.
-
teuf July 28th, 2009 @ 01:47 PM
Might be worth having a warning or something when assignments from one of the size_t variable overflows the uint32_t it's assigned to.
-
Matt Colyer July 29th, 2009 @ 04:33 AM
- State changed from “open” to “resolved”
(from [c57ebf917e30afd78dac8042552966811531c632]) Fix potential memory corruption in calls to gnutls function on 64 bit arch
[#60 state:resolved]
Signed-off-by: Matt Colyer matt@colyer.name
http://github.com/MattColyer/libiphone/commit/c57ebf917e30afd78dac8...
Please Sign in or create a free account to add a new ticket.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.
Create new ticket
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป
A project around supporting the iPhone in Linux.
See http://libimobiledevice.org
People watching this ticket
Matt Colyer
Attachments
Referenced by
-
60
[PATCH] potential memory corruption in calls to gnutls function on 64 bit arch
[#60
state:resolved]