Bug 1183982

Summary:	Memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_url
Product:	Red Hat Enterprise Linux 7	Reporter:	Christophe Fergeau <cfergeau>
Component:	rest	Assignee:	Debarshi Ray <debarshir>
Status:	CLOSED ERRATA	QA Contact:	Lukáš Zachar <lzachar>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.2	CC:	bgollahe, fweimer, isenfeld
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	rest-0.7.92-2.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-11-19 08:33:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1199049

Description Christophe Fergeau 2015-01-20 11:09:54 UTC

See https://bugzilla.gnome.org/show_bug.cgi?id=742644 for a detailed description:

« 
Debarshi Ray [reporter] [developer] 2015-01-09 13:37:20 UTC 


The librest build has this warning which is not as harmless as it might appear:
  CC       librest_0.7_la-oauth-proxy-call.lo
oauth-proxy-call.c: In function 'sign_hmac':
oauth-proxy-call.c:130:3: warning: implicit declaration of function
'rest_proxy_call_get_url' [-Wimplicit-function-declaration]
   url_str = rest_proxy_call_get_url (call);
   ^
oauth-proxy-call.c:130:11: warning: assignment makes pointer from integer
without a cast
   url_str = rest_proxy_call_get_url (call);
           ^
The compiler assumes int as the return type, but in reality it returns a
pointer. Using the function without a prototype will lead to memory errors when
the size of an int is not the same as a pointer.

You can trigger a crash by running the EnsureCredentials method from the
org.gnome.OnlineAccounts.Account interface on an object representing a Flickr
account.
»

Fixed by https://git.gnome.org/browse/librest/commit/?id=b50ace7738ea03817acdad87fb2b338a86018329

Comment 1 Christophe Fergeau 2015-01-20 11:11:44 UTC

Moving to POST as a patch is available for this issue.

Comment 3 Florian Weimer 2015-03-04 10:57:03 UTC

CVE request posted: http://www.openwall.com/lists/oss-security/2015/03/04/6

Comment 12 Debarshi Ray 2015-05-07 16:21:34 UTC

I have built rest-0.7.92-2.el7:
https://brewweb.devel.redhat.com/taskinfo?taskID=9127499

Comment 16 errata-xmlrpc 2015-11-19 08:33:31 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2237.html