op public repos

Blame

Date:: Tue Feb 8 10:48:04 2022 UTC
Message:: fix infinite loop in got-index-pack for pack files >= 4GB in size Because of a missing range check our zlib wrapper would end up calling zlib over and over with zero bytes of input. Problem reported by semarie and naddy. Fixed with help from millert@. ok millert naddy
Actions:: History | Blob | Raw File
  1 2181e0c8 2019-03-19 stsp /*
  2 2181e0c8 2019-03-19 stsp  * Copyright (c) 2019 Stefan Sperling <stsp@openbsd.org>
  3 2181e0c8 2019-03-19 stsp  *
  4 2181e0c8 2019-03-19 stsp  * Permission to use, copy, modify, and distribute this software for any
  5 2181e0c8 2019-03-19 stsp  * purpose with or without fee is hereby granted, provided that the above
  6 2181e0c8 2019-03-19 stsp  * copyright notice and this permission notice appear in all copies.
  7 2181e0c8 2019-03-19 stsp  *
  8 2181e0c8 2019-03-19 stsp  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  9 2181e0c8 2019-03-19 stsp  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 10 2181e0c8 2019-03-19 stsp  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 11 2181e0c8 2019-03-19 stsp  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 12 2181e0c8 2019-03-19 stsp  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 13 2181e0c8 2019-03-19 stsp  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 14 2181e0c8 2019-03-19 stsp  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 15 2181e0c8 2019-03-19 stsp  */
 16 2181e0c8 2019-03-19 stsp 
 17 2181e0c8 2019-03-19 stsp #include <sys/queue.h>
 18 2181e0c8 2019-03-19 stsp 
 19 2181e0c8 2019-03-19 stsp #include <errno.h>
 20 2181e0c8 2019-03-19 stsp #include <stdio.h>
 21 2181e0c8 2019-03-19 stsp #include <stdlib.h>
 22 2181e0c8 2019-03-19 stsp #include <string.h>
 23 2181e0c8 2019-03-19 stsp #include <sha1.h>
 24 2181e0c8 2019-03-19 stsp #include <zlib.h>
 25 2181e0c8 2019-03-19 stsp #include <time.h>
 26 2181e0c8 2019-03-19 stsp 
 27 2181e0c8 2019-03-19 stsp #include "got_error.h"
 28 2181e0c8 2019-03-19 stsp #include "got_object.h"
 29 324d37e7 2019-05-11 stsp #include "got_path.h"
 30 2181e0c8 2019-03-19 stsp 
 31 2181e0c8 2019-03-19 stsp #include "got_lib_deflate.h"
 32 2181e0c8 2019-03-19 stsp 
 33 2181e0c8 2019-03-19 stsp #ifndef MIN
 34 2181e0c8 2019-03-19 stsp #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
 35 2181e0c8 2019-03-19 stsp #endif
 36 2181e0c8 2019-03-19 stsp 
 37 2181e0c8 2019-03-19 stsp const struct got_error *
 38 3b9e6fcf 2021-06-05 stsp got_deflate_init(struct got_deflate_buf *zb, uint8_t *outbuf, size_t bufsize)
 39 2181e0c8 2019-03-19 stsp {
 40 2181e0c8 2019-03-19 stsp 	const struct got_error *err = NULL;
 41 2181e0c8 2019-03-19 stsp 	int zerr;
 42 2181e0c8 2019-03-19 stsp 
 43 2181e0c8 2019-03-19 stsp 	memset(&zb->z, 0, sizeof(zb->z));
 44 2181e0c8 2019-03-19 stsp 
 45 2181e0c8 2019-03-19 stsp 	zb->z.zalloc = Z_NULL;
 46 2181e0c8 2019-03-19 stsp 	zb->z.zfree = Z_NULL;
 47 2181e0c8 2019-03-19 stsp 	zerr = deflateInit(&zb->z, Z_DEFAULT_COMPRESSION);
 48 2181e0c8 2019-03-19 stsp 	if (zerr != Z_OK) {
 49 2181e0c8 2019-03-19 stsp 		if  (zerr == Z_ERRNO)
 50 638f9024 2019-05-13 stsp 			return got_error_from_errno("deflateInit");
 51 2181e0c8 2019-03-19 stsp 		if  (zerr == Z_MEM_ERROR) {
 52 2181e0c8 2019-03-19 stsp 			errno = ENOMEM;
 53 638f9024 2019-05-13 stsp 			return got_error_from_errno("deflateInit");
 54 2181e0c8 2019-03-19 stsp 		}
 55 2181e0c8 2019-03-19 stsp 		return got_error(GOT_ERR_COMPRESSION);
 56 2181e0c8 2019-03-19 stsp 	}
 57 2181e0c8 2019-03-19 stsp 
 58 2181e0c8 2019-03-19 stsp 	zb->inlen = zb->outlen = bufsize;
 59 2181e0c8 2019-03-19 stsp 
 60 2181e0c8 2019-03-19 stsp 	zb->inbuf = calloc(1, zb->inlen);
 61 2181e0c8 2019-03-19 stsp 	if (zb->inbuf == NULL) {
 62 638f9024 2019-05-13 stsp 		err = got_error_from_errno("calloc");
 63 2181e0c8 2019-03-19 stsp 		goto done;
 64 2181e0c8 2019-03-19 stsp 	}
 65 2181e0c8 2019-03-19 stsp 
 66 2181e0c8 2019-03-19 stsp 	zb->flags = 0;
 67 2181e0c8 2019-03-19 stsp 	if (outbuf == NULL) {
 68 2181e0c8 2019-03-19 stsp 		zb->outbuf = calloc(1, zb->outlen);
 69 2181e0c8 2019-03-19 stsp 		if (zb->outbuf == NULL) {
 70 638f9024 2019-05-13 stsp 			err = got_error_from_errno("calloc");
 71 2181e0c8 2019-03-19 stsp 			goto done;
 72 2181e0c8 2019-03-19 stsp 		}
 73 2181e0c8 2019-03-19 stsp 		zb->flags |= GOT_DEFLATE_F_OWN_OUTBUF;
 74 2181e0c8 2019-03-19 stsp 	} else
 75 2181e0c8 2019-03-19 stsp 		zb->outbuf = outbuf;
 76 2181e0c8 2019-03-19 stsp done:
 77 2181e0c8 2019-03-19 stsp 	if (err)
 78 2181e0c8 2019-03-19 stsp 		got_deflate_end(zb);
 79 2181e0c8 2019-03-19 stsp 	return err;
 80 2181e0c8 2019-03-19 stsp }
 81 2181e0c8 2019-03-19 stsp 
 82 91b40e30 2021-05-21 stsp static void
 83 31e61ec1 2021-09-28 naddy csum_output(struct got_deflate_checksum *csum, const uint8_t *buf, size_t len)
 84 91b40e30 2021-05-21 stsp {
 85 91b40e30 2021-05-21 stsp 	if (csum->output_crc)
 86 91b40e30 2021-05-21 stsp 		*csum->output_crc = crc32(*csum->output_crc, buf, len);
 87 91b40e30 2021-05-21 stsp 
 88 91b40e30 2021-05-21 stsp 	if (csum->output_sha1)
 89 91b40e30 2021-05-21 stsp 		SHA1Update(csum->output_sha1, buf, len);
 90 91b40e30 2021-05-21 stsp }
 91 91b40e30 2021-05-21 stsp 
 92 2181e0c8 2019-03-19 stsp const struct got_error *
 93 72840534 2022-01-19 stsp got_deflate_read(struct got_deflate_buf *zb, FILE *f, off_t len,
 94 72840534 2022-01-19 stsp     size_t *outlenp, off_t *consumed)
 95 2181e0c8 2019-03-19 stsp {
 96 2181e0c8 2019-03-19 stsp 	size_t last_total_out = zb->z.total_out;
 97 2181e0c8 2019-03-19 stsp 	z_stream *z = &zb->z;
 98 2181e0c8 2019-03-19 stsp 	int ret = Z_ERRNO;
 99 2181e0c8 2019-03-19 stsp 
100 2181e0c8 2019-03-19 stsp 	z->next_out = zb->outbuf;
101 2181e0c8 2019-03-19 stsp 	z->avail_out = zb->outlen;
102 2181e0c8 2019-03-19 stsp 
103 2181e0c8 2019-03-19 stsp 	*outlenp = 0;
104 72840534 2022-01-19 stsp 	*consumed = 0;
105 2181e0c8 2019-03-19 stsp 	do {
106 72840534 2022-01-19 stsp 		size_t last_total_in = z->total_in;
107 2181e0c8 2019-03-19 stsp 		if (z->avail_in == 0) {
108 72840534 2022-01-19 stsp 			size_t n = 0;
109 72840534 2022-01-19 stsp 			if (*consumed < len) {
110 72840534 2022-01-19 stsp 				n = fread(zb->inbuf, 1,
111 72840534 2022-01-19 stsp 				    MIN(zb->inlen, len - *consumed), f);
112 72840534 2022-01-19 stsp 			}
113 2181e0c8 2019-03-19 stsp 			if (n == 0) {
114 2181e0c8 2019-03-19 stsp 				if (ferror(f))
115 2181e0c8 2019-03-19 stsp 					return got_ferror(f, GOT_ERR_IO);
116 2181e0c8 2019-03-19 stsp 				/* EOF */
117 4e4a7005 2019-04-13 stsp 				ret = deflate(z, Z_FINISH);
118 2181e0c8 2019-03-19 stsp 				break;
119 2181e0c8 2019-03-19 stsp 			}
120 2181e0c8 2019-03-19 stsp 			z->next_in = zb->inbuf;
121 2181e0c8 2019-03-19 stsp 			z->avail_in = n;
122 2181e0c8 2019-03-19 stsp 		}
123 2181e0c8 2019-03-19 stsp 		ret = deflate(z, Z_NO_FLUSH);
124 72840534 2022-01-19 stsp 		*consumed += z->total_in - last_total_in;
125 2181e0c8 2019-03-19 stsp 	} while (ret == Z_OK && z->avail_out > 0);
126 2181e0c8 2019-03-19 stsp 
127 2181e0c8 2019-03-19 stsp 	if (ret == Z_OK) {
128 2181e0c8 2019-03-19 stsp 		zb->flags |= GOT_DEFLATE_F_HAVE_MORE;
129 2181e0c8 2019-03-19 stsp 	} else {
130 2181e0c8 2019-03-19 stsp 		if (ret != Z_STREAM_END)
131 2181e0c8 2019-03-19 stsp 			return got_error(GOT_ERR_COMPRESSION);
132 2181e0c8 2019-03-19 stsp 		zb->flags &= ~GOT_DEFLATE_F_HAVE_MORE;
133 2181e0c8 2019-03-19 stsp 	}
134 2181e0c8 2019-03-19 stsp 
135 2181e0c8 2019-03-19 stsp 	*outlenp = z->total_out - last_total_out;
136 2181e0c8 2019-03-19 stsp 	return NULL;
137 2181e0c8 2019-03-19 stsp }
138 2181e0c8 2019-03-19 stsp 
139 64a8571e 2022-01-07 stsp const struct got_error *
140 64a8571e 2022-01-07 stsp got_deflate_read_mmap(struct got_deflate_buf *zb, uint8_t *map, size_t offset,
141 64a8571e 2022-01-07 stsp     size_t len, size_t *outlenp, size_t *consumed)
142 64a8571e 2022-01-07 stsp {
143 64a8571e 2022-01-07 stsp 	z_stream *z = &zb->z;
144 64a8571e 2022-01-07 stsp 	size_t last_total_out = z->total_out;
145 64a8571e 2022-01-07 stsp 	int ret = Z_ERRNO;
146 64a8571e 2022-01-07 stsp 
147 64a8571e 2022-01-07 stsp 	z->next_out = zb->outbuf;
148 64a8571e 2022-01-07 stsp 	z->avail_out = zb->outlen;
149 64a8571e 2022-01-07 stsp 
150 64a8571e 2022-01-07 stsp 	*outlenp = 0;
151 64a8571e 2022-01-07 stsp 	*consumed = 0;
152 64a8571e 2022-01-07 stsp 	do {
153 64a8571e 2022-01-07 stsp 		size_t last_total_in = z->total_in;
154 64a8571e 2022-01-07 stsp 		if (z->avail_in == 0) {
155 64a8571e 2022-01-07 stsp 			z->next_in = map + offset + *consumed;
156 a9bd296d 2022-02-08 stsp 			if (len - *consumed > UINT_MAX)
157 a9bd296d 2022-02-08 stsp 				z->avail_in = UINT_MAX;
158 a9bd296d 2022-02-08 stsp 			else
159 a9bd296d 2022-02-08 stsp 				z->avail_in = len - *consumed;
160 64a8571e 2022-01-07 stsp 			if (z->avail_in == 0) {
161 64a8571e 2022-01-07 stsp 				/* EOF */
162 64a8571e 2022-01-07 stsp 				ret = deflate(z, Z_FINISH);
163 64a8571e 2022-01-07 stsp 				break;
164 64a8571e 2022-01-07 stsp 			}
165 64a8571e 2022-01-07 stsp 		}
166 64a8571e 2022-01-07 stsp 		ret = deflate(z, Z_NO_FLUSH);
167 64a8571e 2022-01-07 stsp 		*consumed += z->total_in - last_total_in;
168 64a8571e 2022-01-07 stsp 	} while (ret == Z_OK && z->avail_out > 0);
169 64a8571e 2022-01-07 stsp 
170 64a8571e 2022-01-07 stsp 	if (ret == Z_OK) {
171 64a8571e 2022-01-07 stsp 		zb->flags |= GOT_DEFLATE_F_HAVE_MORE;
172 64a8571e 2022-01-07 stsp 	} else {
173 64a8571e 2022-01-07 stsp 		if (ret != Z_STREAM_END)
174 64a8571e 2022-01-07 stsp 			return got_error(GOT_ERR_COMPRESSION);
175 64a8571e 2022-01-07 stsp 		zb->flags &= ~GOT_DEFLATE_F_HAVE_MORE;
176 64a8571e 2022-01-07 stsp 	}
177 64a8571e 2022-01-07 stsp 
178 64a8571e 2022-01-07 stsp 	*outlenp = z->total_out - last_total_out;
179 64a8571e 2022-01-07 stsp 	return NULL;
180 64a8571e 2022-01-07 stsp }
181 64a8571e 2022-01-07 stsp 
182 2181e0c8 2019-03-19 stsp void
183 2181e0c8 2019-03-19 stsp got_deflate_end(struct got_deflate_buf *zb)
184 2181e0c8 2019-03-19 stsp {
185 2181e0c8 2019-03-19 stsp 	free(zb->inbuf);
186 2181e0c8 2019-03-19 stsp 	if (zb->flags & GOT_DEFLATE_F_OWN_OUTBUF)
187 2181e0c8 2019-03-19 stsp 		free(zb->outbuf);
188 2181e0c8 2019-03-19 stsp 	deflateEnd(&zb->z);
189 2181e0c8 2019-03-19 stsp }
190 2181e0c8 2019-03-19 stsp 
191 2181e0c8 2019-03-19 stsp const struct got_error *
192 72840534 2022-01-19 stsp got_deflate_to_file(off_t *outlen, FILE *infile, off_t len,
193 72840534 2022-01-19 stsp     FILE *outfile, struct got_deflate_checksum *csum)
194 2181e0c8 2019-03-19 stsp {
195 2181e0c8 2019-03-19 stsp 	const struct got_error *err;
196 2181e0c8 2019-03-19 stsp 	size_t avail;
197 72840534 2022-01-19 stsp 	off_t consumed;
198 2181e0c8 2019-03-19 stsp 	struct got_deflate_buf zb;
199 2181e0c8 2019-03-19 stsp 
200 3b9e6fcf 2021-06-05 stsp 	err = got_deflate_init(&zb, NULL, GOT_DEFLATE_BUFSIZE);
201 2181e0c8 2019-03-19 stsp 	if (err)
202 2181e0c8 2019-03-19 stsp 		goto done;
203 2181e0c8 2019-03-19 stsp 
204 2181e0c8 2019-03-19 stsp 	*outlen = 0;
205 2181e0c8 2019-03-19 stsp 
206 2181e0c8 2019-03-19 stsp 	do {
207 72840534 2022-01-19 stsp 		err = got_deflate_read(&zb, infile, len, &avail, &consumed);
208 2181e0c8 2019-03-19 stsp 		if (err)
209 2181e0c8 2019-03-19 stsp 			goto done;
210 72840534 2022-01-19 stsp 		len -= consumed;
211 2181e0c8 2019-03-19 stsp 		if (avail > 0) {
212 2181e0c8 2019-03-19 stsp 			size_t n;
213 2181e0c8 2019-03-19 stsp 			n = fwrite(zb.outbuf, avail, 1, outfile);
214 2181e0c8 2019-03-19 stsp 			if (n != 1) {
215 2181e0c8 2019-03-19 stsp 				err = got_ferror(outfile, GOT_ERR_IO);
216 2181e0c8 2019-03-19 stsp 				goto done;
217 2181e0c8 2019-03-19 stsp 			}
218 3b9e6fcf 2021-06-05 stsp 			if (csum)
219 3b9e6fcf 2021-06-05 stsp 				csum_output(csum, zb.outbuf, avail);
220 2181e0c8 2019-03-19 stsp 			*outlen += avail;
221 2181e0c8 2019-03-19 stsp 		}
222 2181e0c8 2019-03-19 stsp 	} while (zb.flags & GOT_DEFLATE_F_HAVE_MORE);
223 2181e0c8 2019-03-19 stsp 
224 2181e0c8 2019-03-19 stsp done:
225 2181e0c8 2019-03-19 stsp 	got_deflate_end(&zb);
226 2181e0c8 2019-03-19 stsp 	return err;
227 2181e0c8 2019-03-19 stsp }
228 64a8571e 2022-01-07 stsp 
229 64a8571e 2022-01-07 stsp const struct got_error *
230 72840534 2022-01-19 stsp got_deflate_to_file_mmap(off_t *outlen, uint8_t *map, size_t offset,
231 64a8571e 2022-01-07 stsp     size_t len, FILE *outfile, struct got_deflate_checksum *csum)
232 64a8571e 2022-01-07 stsp {
233 64a8571e 2022-01-07 stsp 	const struct got_error *err;
234 64a8571e 2022-01-07 stsp 	size_t avail, consumed;
235 64a8571e 2022-01-07 stsp 	struct got_deflate_buf zb;
236 64a8571e 2022-01-07 stsp 
237 64a8571e 2022-01-07 stsp 	err = got_deflate_init(&zb, NULL, GOT_DEFLATE_BUFSIZE);
238 64a8571e 2022-01-07 stsp 	if (err)
239 64a8571e 2022-01-07 stsp 		goto done;
240 64a8571e 2022-01-07 stsp 
241 64a8571e 2022-01-07 stsp 	*outlen = 0;
242 64a8571e 2022-01-07 stsp 	do {
243 64a8571e 2022-01-07 stsp 		err = got_deflate_read_mmap(&zb, map, offset, len, &avail,
244 64a8571e 2022-01-07 stsp 		    &consumed);
245 64a8571e 2022-01-07 stsp 		if (err)
246 64a8571e 2022-01-07 stsp 			goto done;
247 64a8571e 2022-01-07 stsp 		offset += consumed;
248 64a8571e 2022-01-07 stsp 		len -= consumed;
249 64a8571e 2022-01-07 stsp 		if (avail > 0) {
250 64a8571e 2022-01-07 stsp 			size_t n;
251 64a8571e 2022-01-07 stsp 			n = fwrite(zb.outbuf, avail, 1, outfile);
252 64a8571e 2022-01-07 stsp 			if (n != 1) {
253 64a8571e 2022-01-07 stsp 				err = got_ferror(outfile, GOT_ERR_IO);
254 64a8571e 2022-01-07 stsp 				goto done;
255 64a8571e 2022-01-07 stsp 			}
256 64a8571e 2022-01-07 stsp 			if (csum)
257 64a8571e 2022-01-07 stsp 				csum_output(csum, zb.outbuf, avail);
258 64a8571e 2022-01-07 stsp 			*outlen += avail;
259 64a8571e 2022-01-07 stsp 		}
260 64a8571e 2022-01-07 stsp 	} while (zb.flags & GOT_DEFLATE_F_HAVE_MORE);
261 64a8571e 2022-01-07 stsp 
262 64a8571e 2022-01-07 stsp done:
263 64a8571e 2022-01-07 stsp 	got_deflate_end(&zb);
264 64a8571e 2022-01-07 stsp 	return err;
265 64a8571e 2022-01-07 stsp }