mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
369686267a
qemu/crypto
History
Marc-André Lureau 83e33300a2 crypto: fix stack-buffer-overflow error 
ASAN complains about:

==8856==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd8a1fe168 at pc 0x561136cb4451 bp 0x7ffd8a1fe130 sp 0x7ffd8a1fd8e0
READ of size 16 at 0x7ffd8a1fe168 thread T0
    #0 0x561136cb4450 in __asan_memcpy (/home/elmarco/src/qq/build/tests/test-crypto-ivgen+0x110450)
    #1 0x561136d2a6a7 in qcrypto_ivgen_essiv_calculate /home/elmarco/src/qq/crypto/ivgen-essiv.c:83:5
    #2 0x561136d29af8 in qcrypto_ivgen_calculate /home/elmarco/src/qq/crypto/ivgen.c:72:12
    #3 0x561136d07c8e in test_ivgen /home/elmarco/src/qq/tests/test-crypto-ivgen.c:148:5
    #4 0x7f77772c3b04 in test_case_run /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2237
    #5 0x7f77772c3ec4 in g_test_run_suite_internal /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2321
    #6 0x7f77772c3f6d in g_test_run_suite_internal /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2333
    #7 0x7f77772c3f6d in g_test_run_suite_internal /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2333
    #8 0x7f77772c3f6d in g_test_run_suite_internal /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2333
    #9 0x7f77772c4184 in g_test_run_suite /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2408
    #10 0x7f77772c2e0d in g_test_run /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:1674
    #11 0x561136d0799b in main /home/elmarco/src/qq/tests/test-crypto-ivgen.c:173:12
    #12 0x7f77756e6039 in __libc_start_main (/lib64/libc.so.6+0x21039)
    #13 0x561136c13d89 in _start (/home/elmarco/src/qq/build/tests/test-crypto-ivgen+0x6fd89)

Address 0x7ffd8a1fe168 is located in stack of thread T0 at offset 40 in frame
    #0 0x561136d2a40f in qcrypto_ivgen_essiv_calculate /home/elmarco/src/qq/crypto/ivgen-essiv.c:76

  This frame has 1 object(s):
    [32, 40) 'sector.addr' <== Memory access at offset 40 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/elmarco/src/qq/build/tests/test-crypto-ivgen+0x110450) in __asan_memcpy
Shadow bytes around the buggy address:
  0x100031437bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437bf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100031437c20: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00[f3]f3 f3
  0x100031437c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437c50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437c60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

It looks like the rest of the code copes with ndata being larger than
sizeof(sector), so limit the memcpy() range.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <20180104160523.22995-13-marcandre.lureau@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-01-16 14:54:50 +01:00
..
aes.c
afalg.c crypto: introduce some common functions for af_alg backend 2017-07-19 10:11:05 +01:00
afalgpriv.h crypto: hash: add afalg-backend hash support 2017-07-19 10:11:05 +01:00
afsplit.c qemu-common: stop including qemu/bswap.h from qemu-common.h 2016-05-19 16:42:28 +02:00
block-luks.c block: convert qcrypto_block_encrypt|decrypt to take bytes offset 2017-10-06 16:30:47 +02:00
block-luks.h Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
block-qcow.c block: convert qcrypto_block_encrypt|decrypt to take bytes offset 2017-10-06 16:30:47 +02:00
block-qcow.h Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
block.c block: convert qcrypto_block_encrypt|decrypt to take bytes offset 2017-10-06 16:30:47 +02:00
blockpriv.h block: convert qcrypto_block_encrypt|decrypt to take bytes offset 2017-10-06 16:30:47 +02:00
cipher-afalg.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
cipher-builtin.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
cipher-gcrypt.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
cipher-nettle.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
cipher.c crypto: afalg: fix a NULL pointer dereference 2017-11-08 11:05:09 +00:00
cipherpriv.h crypto: cipher: add afalg-backend cipher support 2017-07-19 10:11:05 +01:00
desrfb.c
hash-afalg.c crypto: hmac: add af_alg-backend hmac support 2017-07-19 10:11:05 +01:00
hash-gcrypt.c crypto: hash: add hash driver framework 2017-07-19 10:11:04 +01:00
hash-glib.c crypto: hash: add hash driver framework 2017-07-19 10:11:04 +01:00
hash-nettle.c crypto: hash: add hash driver framework 2017-07-19 10:11:04 +01:00
hash.c crypto: afalg: fix a NULL pointer dereference 2017-11-08 11:05:09 +00:00
hashpriv.h crypto: hash: add afalg-backend hash support 2017-07-19 10:11:05 +01:00
hmac-gcrypt.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
hmac-glib.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
hmac-nettle.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
hmac.c crypto: afalg: fix a NULL pointer dereference 2017-11-08 11:05:09 +00:00
hmacpriv.h crypto: hmac: add af_alg-backend hmac support 2017-07-19 10:11:05 +01:00
init.c crypto: qcrypto_random_bytes() now works on windows w/o any other crypto libs 2017-05-09 14:41:47 +01:00
ivgen-essiv.c crypto: fix stack-buffer-overflow error 2018-01-16 14:54:50 +01:00
ivgen-essiv.h
ivgen-plain64.c
ivgen-plain64.h
ivgen-plain.c
ivgen-plain.h
ivgen.c
ivgenpriv.h Clean up header guards that don't match their file name 2016-07-12 16:19:16 +02:00
Makefile.objs crypto: hash: add afalg-backend hash support 2017-07-19 10:11:05 +01:00
pbkdf-gcrypt.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
pbkdf-nettle.c qapi: Mechanically convert FOO_lookup[...] to FOO_str(...) 2017-09-04 13:09:13 +02:00
pbkdf-stub.c crypto: use uint64_t for pbkdf iteration count parameters 2016-09-19 16:30:42 +01:00
pbkdf.c crypto: use correct derived key size when timing pbkdf 2016-09-19 16:30:45 +01:00
random-gcrypt.c crypto: qcrypto_random_bytes() now works on windows w/o any other crypto libs 2017-05-09 14:41:47 +01:00
random-gnutls.c crypto: qcrypto_random_bytes() now works on windows w/o any other crypto libs 2017-05-09 14:41:47 +01:00
random-platform.c fix mingw build failure 2017-05-16 15:33:25 +01:00
secret.c qapi: Change data type of the FOO_lookup generated for enum FOO 2017-09-04 13:09:13 +02:00
tlscreds.c qapi: Change data type of the FOO_lookup generated for enum FOO 2017-09-04 13:09:13 +02:00
tlscredsanon.c
tlscredspriv.h Clean up header guards that don't match their file name 2016-07-12 16:19:16 +02:00
tlscredsx509.c crypto: fix building complaint 2016-09-12 12:00:52 +01:00
tlssession.c crypto: add trace points for TLS cert verification 2016-09-19 16:30:46 +01:00
trace-events docs: fix broken paths to docs/devel/tracing.txt 2017-07-31 13:12:53 +03:00
xts.c