[packages/libuv] upstream fix for CVE-2021-22918; rel 2
atler
atler at pld-linux.org
Tue Jul 6 13:10:02 CEST 2021
commit 52b5b29e47749d457e3ed31b0bbe1ccfcf43fef1
Author: Jan Palus <atler at pld-linux.org>
Date: Tue Jul 6 13:08:14 2021 +0200
upstream fix for CVE-2021-22918; rel 2
CVE-2021-22918.patch | 218 +++++++++++++++++++++++++++++++++++++++++++++++++++
libuv.spec | 4 +-
2 files changed, 221 insertions(+), 1 deletion(-)
---
diff --git a/libuv.spec b/libuv.spec
index 6f3cb70..348dc31 100644
--- a/libuv.spec
+++ b/libuv.spec
@@ -7,12 +7,13 @@ Summary: Multi-platform support library with a focus on asynchronous I/O
Summary(pl.UTF-8): Wieloplatformowa biblioteka wspierająca skupiająca się na asynchronicznym we/wy
Name: libuv
Version: 1.41.0
-Release: 1
+Release: 2
# the licensing breakdown is described in detail in the LICENSE file
License: MIT and BSD and ISC
Group: Libraries
Source0: https://dist.libuv.org/dist/v%{version}/%{name}-v%{version}.tar.gz
# Source0-md5: d990b0770dd2b15f7a8399580d55d32c
+Patch0: CVE-2021-22918.patch
URL: http://libuv.org/
BuildRequires: autoconf >= 2.57
BuildRequires: automake >= 1:1.12
@@ -57,6 +58,7 @@ Statyczna biblioteka libuv.
%prep
%setup -q -n %{name}-v%{version}
+%patch0 -p1
# serial-tests is available in v1.12 and newer.
echo "m4_define([UV_EXTRA_AUTOMAKE_FLAGS], [serial-tests])" > m4/libuv-extra-automake-flags.m4
diff --git a/CVE-2021-22918.patch b/CVE-2021-22918.patch
new file mode 100644
index 0000000..d16804d
--- /dev/null
+++ b/CVE-2021-22918.patch
@@ -0,0 +1,218 @@
+From b7466e31e4bee160d82a68fca11b1f61d46debae Mon Sep 17 00:00:00 2001
+From: Ben Noordhuis <info at bnoordhuis.nl>
+Date: Fri, 21 May 2021 11:23:36 +0200
+Subject: [PATCH] idna: fix OOB read in punycode decoder
+
+libuv was vulnerable to out-of-bounds reads in the uv__idna_toascii()
+function which is used to convert strings to ASCII. This is called by
+the DNS resolution function and can lead to information disclosures or
+crashes.
+
+Reported by Eric Sesterhenn in collaboration with Cure53 and ExpressVPN.
+
+Reported-By: Eric Sesterhenn <eric.sesterhenn at x41-dsec.de>
+Fixes: https://github.com/libuv/libuv/issues/3147
+PR-URL: https://github.com/libuv/libuv-private/pull/1
+Refs: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918
+Reviewed-By: Colin Ihrig <cjihrig at gmail.com>
+Reviewed-By: Richard Lau <riclau at uk.ibm.com>
+---
+ src/idna.c | 49 +++++++++++++++++++++++++++++++++++-------------
+ test/test-idna.c | 19 +++++++++++++++++++
+ test/test-list.h | 2 ++
+ 3 files changed, 57 insertions(+), 13 deletions(-)
+
+diff --git a/src/idna.c b/src/idna.c
+index 13ffac6be8..b44cb16a1e 100644
+--- a/src/idna.c
++++ b/src/idna.c
+@@ -19,6 +19,7 @@
+
+ #include "uv.h"
+ #include "idna.h"
++#include <assert.h>
+ #include <string.h>
+
+ static unsigned uv__utf8_decode1_slow(const char** p,
+@@ -32,7 +33,7 @@ static unsigned uv__utf8_decode1_slow(const char** p,
+ if (a > 0xF7)
+ return -1;
+
+- switch (*p - pe) {
++ switch (pe - *p) {
+ default:
+ if (a > 0xEF) {
+ min = 0x10000;
+@@ -62,6 +63,8 @@ static unsigned uv__utf8_decode1_slow(const char** p,
+ a = 0;
+ break;
+ }
++ /* Fall through. */
++ case 0:
+ return -1; /* Invalid continuation byte. */
+ }
+
+@@ -88,6 +91,8 @@ static unsigned uv__utf8_decode1_slow(const char** p,
+ unsigned uv__utf8_decode1(const char** p, const char* pe) {
+ unsigned a;
+
++ assert(*p < pe);
++
+ a = (unsigned char) *(*p)++;
+
+ if (a < 128)
+@@ -96,9 +101,6 @@ unsigned uv__utf8_decode1(const char** p, const char* pe) {
+ return uv__utf8_decode1_slow(p, pe, a);
+ }
+
+-#define foreach_codepoint(c, p, pe) \
+- for (; (void) (*p <= pe && (c = uv__utf8_decode1(p, pe))), *p <= pe;)
+-
+ static int uv__idna_toascii_label(const char* s, const char* se,
+ char** d, char* de) {
+ static const char alphabet[] = "abcdefghijklmnopqrstuvwxyz0123456789";
+@@ -121,15 +123,22 @@ static int uv__idna_toascii_label(const char* s, const char* se,
+ ss = s;
+ todo = 0;
+
+- foreach_codepoint(c, &s, se) {
++ /* Note: after this loop we've visited all UTF-8 characters and know
++ * they're legal so we no longer need to check for decode errors.
++ */
++ while (s < se) {
++ c = uv__utf8_decode1(&s, se);
++
++ if (c == -1u)
++ return UV_EINVAL;
++
+ if (c < 128)
+ h++;
+- else if (c == (unsigned) -1)
+- return UV_EINVAL;
+ else
+ todo++;
+ }
+
++ /* Only write "xn--" when there are non-ASCII characters. */
+ if (todo > 0) {
+ if (*d < de) *(*d)++ = 'x';
+ if (*d < de) *(*d)++ = 'n';
+@@ -137,9 +146,13 @@ static int uv__idna_toascii_label(const char* s, const char* se,
+ if (*d < de) *(*d)++ = '-';
+ }
+
++ /* Write ASCII characters. */
+ x = 0;
+ s = ss;
+- foreach_codepoint(c, &s, se) {
++ while (s < se) {
++ c = uv__utf8_decode1(&s, se);
++ assert(c != -1u);
++
+ if (c > 127)
+ continue;
+
+@@ -166,10 +179,15 @@ static int uv__idna_toascii_label(const char* s, const char* se,
+ while (todo > 0) {
+ m = -1;
+ s = ss;
+- foreach_codepoint(c, &s, se)
++
++ while (s < se) {
++ c = uv__utf8_decode1(&s, se);
++ assert(c != -1u);
++
+ if (c >= n)
+ if (c < m)
+ m = c;
++ }
+
+ x = m - n;
+ y = h + 1;
+@@ -181,7 +199,10 @@ static int uv__idna_toascii_label(const char* s, const char* se,
+ n = m;
+
+ s = ss;
+- foreach_codepoint(c, &s, se) {
++ while (s < se) {
++ c = uv__utf8_decode1(&s, se);
++ assert(c != -1u);
++
+ if (c < n)
+ if (++delta == 0)
+ return UV_E2BIG; /* Overflow. */
+@@ -245,8 +266,6 @@ static int uv__idna_toascii_label(const char* s, const char* se,
+ return 0;
+ }
+
+-#undef foreach_codepoint
+-
+ long uv__idna_toascii(const char* s, const char* se, char* d, char* de) {
+ const char* si;
+ const char* st;
+@@ -256,10 +275,14 @@ long uv__idna_toascii(const char* s, const char* se, char* d, char* de) {
+
+ ds = d;
+
+- for (si = s; si < se; /* empty */) {
++ si = s;
++ while (si < se) {
+ st = si;
+ c = uv__utf8_decode1(&si, se);
+
++ if (c == -1u)
++ return UV_EINVAL;
++
+ if (c != '.')
+ if (c != 0x3002) /* 。 */
+ if (c != 0xFF0E) /* ． */
+diff --git a/test/test-idna.c b/test/test-idna.c
+index b76853cb99..f4fad9653d 100644
+--- a/test/test-idna.c
++++ b/test/test-idna.c
+@@ -96,6 +96,25 @@ TEST_IMPL(utf8_decode1) {
+ return 0;
+ }
+
++TEST_IMPL(utf8_decode1_overrun) {
++ const char* p;
++ char b[1];
++
++ /* Single byte. */
++ p = b;
++ b[0] = 0x7F;
++ ASSERT_EQ(0x7F, uv__utf8_decode1(&p, b + 1));
++ ASSERT_EQ(p, b + 1);
++
++ /* Multi-byte. */
++ p = b;
++ b[0] = 0xC0;
++ ASSERT_EQ((unsigned) -1, uv__utf8_decode1(&p, b + 1));
++ ASSERT_EQ(p, b + 1);
++
++ return 0;
++}
++
+ /* Doesn't work on z/OS because that platform uses EBCDIC, not ASCII. */
+ #ifndef __MVS__
+
+diff --git a/test/test-list.h b/test/test-list.h
+index c3c6002ea3..424eea07fa 100644
+--- a/test/test-list.h
++++ b/test/test-list.h
+@@ -528,6 +528,7 @@ TEST_DECLARE (fork_threadpool_queue_work_simple)
+
+ TEST_DECLARE (idna_toascii)
+ TEST_DECLARE (utf8_decode1)
++TEST_DECLARE (utf8_decode1_overrun)
+ TEST_DECLARE (uname)
+
+ TEST_DECLARE (metrics_idle_time)
+@@ -1124,6 +1125,7 @@ TASK_LIST_START
+ #endif
+
+ TEST_ENTRY (utf8_decode1)
++ TEST_ENTRY (utf8_decode1_overrun)
+ TEST_ENTRY (uname)
+
+ /* Doesn't work on z/OS because that platform uses EBCDIC, not ASCII. */
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/libuv.git/commitdiff/52b5b29e47749d457e3ed31b0bbe1ccfcf43fef1
More information about the pld-cvs-commit
mailing list