Blame

Date:
Message:
fspread: fix buffer overflow Without this fix, fspread is trusting the server to return as much data as requested, or less. If a server responds with more data though, fspread writes beyond the bounds of the buffer to fill, which is passed in by the caller. It depends on the caller of fspread() where that buffer is, so there are various possible attack vectors. In the Plan9 kernel, I found this implemented in devmnt.c, where overly large responses are truncated to the size requested before copying, so I assume that this strategy works here too. This also affects fsread() and fsreadn(), which are based on fspread().
Actions:
History | Blob | Raw File
 1 46f79934 2005-01-04 devnull /* Copyright (C) 2003 Russ Cox, Massachusetts Institute of Technology */

 2 46f79934 2005-01-04 devnull /* See COPYRIGHT */

 3 46f79934 2005-01-04 devnull 

 4 46f79934 2005-01-04 devnull #include <u.h>

 5 46f79934 2005-01-04 devnull #include <libc.h>

 6 46f79934 2005-01-04 devnull #include <fcall.h>

 7 46f79934 2005-01-04 devnull #include <9pclient.h>

 8 46f79934 2005-01-04 devnull #include "fsimpl.h"

 9 46f79934 2005-01-04 devnull 

10 46f79934 2005-01-04 devnull long

11 46f79934 2005-01-04 devnull fspread(CFid *fid, void *buf, long n, vlong offset)

12 46f79934 2005-01-04 devnull {

13 46f79934 2005-01-04 devnull 	Fcall tx, rx;

14 46f79934 2005-01-04 devnull 	void *freep;

15 46f79934 2005-01-04 devnull 	uint msize;

16 878b30c0 2021-04-05 crossd 	long nr;

17 46f79934 2005-01-04 devnull 

18 46f79934 2005-01-04 devnull 	msize = fid->fs->msize - IOHDRSZ;

19 46f79934 2005-01-04 devnull 	if(n > msize)

20 46f79934 2005-01-04 devnull 		n = msize;

21 46f79934 2005-01-04 devnull 	tx.type = Tread;

22 46f79934 2005-01-04 devnull 	tx.fid = fid->fid;

23 46f79934 2005-01-04 devnull 	if(offset == -1){

24 46f79934 2005-01-04 devnull 		qlock(&fid->lk);

25 46f79934 2005-01-04 devnull 		tx.offset = fid->offset;

26 46f79934 2005-01-04 devnull 		qunlock(&fid->lk);

27 46f79934 2005-01-04 devnull 	}else

28 46f79934 2005-01-04 devnull 		tx.offset = offset;

29 46f79934 2005-01-04 devnull 	tx.count = n;

30 46f79934 2005-01-04 devnull 

31 46f79934 2005-01-04 devnull 	if(_fsrpc(fid->fs, &tx, &rx, &freep) < 0)

32 46f79934 2005-01-04 devnull 		return -1;

33 46f79934 2005-01-04 devnull 	if(rx.type == Rerror){

34 46f79934 2005-01-04 devnull 		werrstr("%s", rx.ename);

35 46f79934 2005-01-04 devnull 		free(freep);

36 46f79934 2005-01-04 devnull 		return -1;

37 46f79934 2005-01-04 devnull 	}

38 878b30c0 2021-04-05 crossd 	nr = rx.count;

39 878b30c0 2021-04-05 crossd 	if(nr > n)

40 878b30c0 2021-04-05 crossd 		nr = n;

41 878b30c0 2021-04-05 crossd 

42 878b30c0 2021-04-05 crossd 	if(nr){

43 878b30c0 2021-04-05 crossd 		memmove(buf, rx.data, nr);

44 46f79934 2005-01-04 devnull 		if(offset == -1){

45 46f79934 2005-01-04 devnull 			qlock(&fid->lk);

46 878b30c0 2021-04-05 crossd 			fid->offset += nr;

47 46f79934 2005-01-04 devnull 			qunlock(&fid->lk);

48 46f79934 2005-01-04 devnull 		}

49 46f79934 2005-01-04 devnull 	}

50 46f79934 2005-01-04 devnull 	free(freep);

51 fa325e9b 2020-01-10 cross 

52 878b30c0 2021-04-05 crossd 	return nr;

53 46f79934 2005-01-04 devnull }

54 46f79934 2005-01-04 devnull 

55 46f79934 2005-01-04 devnull long

56 46f79934 2005-01-04 devnull fsread(CFid *fid, void *buf, long n)

57 46f79934 2005-01-04 devnull {

58 46f79934 2005-01-04 devnull 	return fspread(fid, buf, n, -1);

59 46f79934 2005-01-04 devnull }

60 46f79934 2005-01-04 devnull 

61 46f79934 2005-01-04 devnull long

62 46f79934 2005-01-04 devnull fsreadn(CFid *fid, void *buf, long n)

63 46f79934 2005-01-04 devnull {

64 46f79934 2005-01-04 devnull 	long tot, nn;

65 46f79934 2005-01-04 devnull 

66 46f79934 2005-01-04 devnull 	for(tot=0; tot<n; tot+=nn){

67 46f79934 2005-01-04 devnull 		nn = fsread(fid, (char*)buf+tot, n-tot);

68 46f79934 2005-01-04 devnull 		if(nn <= 0){

69 46f79934 2005-01-04 devnull 			if(tot == 0)

70 46f79934 2005-01-04 devnull 				return nn;

71 46f79934 2005-01-04 devnull 			break;

72 46f79934 2005-01-04 devnull 		}

73 46f79934 2005-01-04 devnull 	}

74 46f79934 2005-01-04 devnull 	return tot;

75 46f79934 2005-01-04 devnull }