Bug 1027905 - adcli: technically wrong length checks in binary parsers
Summary: adcli: technically wrong length checks in binary parsers
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: adcli
Version: 7.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Sumit Bose
QA Contact: Stefan Dordevic
URL:
Whiteboard:
Depends On:
Blocks: 1027886
TreeView+ depends on / blocked
 
Reported: 2013-11-07 13:19 UTC by Florian Weimer
Modified: 2016-11-04 06:21 UTC (History)
3 users (show)

Fixed In Version: adcli-0.8.1-1.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-04 06:21:42 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
FreeDesktop.org 86971 0 None None None Never
Red Hat Product Errata RHBA-2016:2428 0 normal SHIPPED_LIVE adcli bug fix and enhancement update 2016-11-03 14:00:18 UTC

Description Florian Weimer 2013-11-07 13:19:13 UTC
library/addisco.c has several comparison like the check in this function:

static unsigned short
get_16 (unsigned char **p,
        unsigned char *end)
{
	unsigned short val;
	if ((*p) + 2 > end)
		return 0;
	val = ns_get16 (*p);
	(*p) += 2;
	return val;
}

The problem is that a pointer that points after the element after the last element in the buffer is invalid.  Depending on how this function is call, a smart compiler could optimize away such checks.

The comparison should be written like this:

	if (end - (*p) < 2)

Comment 2 Stef Walter 2013-11-08 09:04:15 UTC
Makes sense, but as you noted is non-critical. Bumping to next release. Will fix upstream in the meantime.

Comment 5 Stef Walter 2015-12-09 10:45:48 UTC
Fixed in git master upstream.

Comment 7 Mike McCune 2016-03-28 23:32:32 UTC
This bug was accidentally moved from POST to MODIFIED via an error in automation, please see mmccune with any questions

Comment 11 errata-xmlrpc 2016-11-04 06:21:42 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2428.html


Note You need to log in before you can comment on or make changes to this bug.