Bug 1027905 - adcli: technically wrong length checks in binary parsers
adcli: technically wrong length checks in binary parsers
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: adcli (Show other bugs)
7.0
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Sumit Bose
Stefan Dordevic
:
Depends On:
Blocks: 1027886
  Show dependency treegraph
 
Reported: 2013-11-07 08:19 EST by Florian Weimer
Modified: 2016-11-04 02:21 EDT (History)
3 users (show)

See Also:
Fixed In Version: adcli-0.8.1-1.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-04 02:21:42 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
FreeDesktop.org 86971 None None None Never

  None (edit)
Description Florian Weimer 2013-11-07 08:19:13 EST
library/addisco.c has several comparison like the check in this function:

static unsigned short
get_16 (unsigned char **p,
        unsigned char *end)
{
	unsigned short val;
	if ((*p) + 2 > end)
		return 0;
	val = ns_get16 (*p);
	(*p) += 2;
	return val;
}

The problem is that a pointer that points after the element after the last element in the buffer is invalid.  Depending on how this function is call, a smart compiler could optimize away such checks.

The comparison should be written like this:

	if (end - (*p) < 2)
Comment 2 Stef Walter 2013-11-08 04:04:15 EST
Makes sense, but as you noted is non-critical. Bumping to next release. Will fix upstream in the meantime.
Comment 5 Stef Walter 2015-12-09 05:45:48 EST
Fixed in git master upstream.
Comment 7 Mike McCune 2016-03-28 19:32:32 EDT
This bug was accidentally moved from POST to MODIFIED via an error in automation, please see mmccune@redhat.com with any questions
Comment 11 errata-xmlrpc 2016-11-04 02:21:42 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2428.html

Note You need to log in before you can comment on or make changes to this bug.