From 51464af713d71802e3c6d5ac15f1a95132a354fe Mon Sep 17 00:00:00 2001
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Mon, 20 Feb 2017 11:13:08 +0100
Subject: [PATCH] cdk_pkt_read: enforce packet limits
That ensures that there are no overflows in the subsequent
calculations.
Resolves the oss-fuzz found bug:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420
Relates: #159
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
---
lib/opencdk/read-packet.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/lib/opencdk/read-packet.c b/lib/opencdk/read-packet.c
index 8055a63..ead6480 100644
--- a/lib/opencdk/read-packet.c
+++ b/lib/opencdk/read-packet.c
@@ -888,7 +888,7 @@ static void skip_packet(cdk_stream_t inp, size_t pktlen)
assert(pktlen == 0);
}
-
+#define MAX_PACKET_LEN (1<<24)
/**
* cdk_pkt_read:
* @inp: the input stream
@@ -940,6 +940,13 @@ cdk_error_t cdk_pkt_read(cdk_stream_t inp, cdk_packet_t pkt)
else
read_old_length(inp, ctb, &pktlen, &pktsize);
+ /* enforce limits to ensure that the following calculations
+ * do not overflow */
+ if (pktlen >= MAX_PACKET_LEN || pktsize >= MAX_PACKET_LEN) {
+ _cdk_log_info("cdk_pkt_read: too long packet\n");
+ return gnutls_assert_val(CDK_Inv_Packet);
+ }
+
pkt->pkttype = pkttype;
pkt->pktlen = pktlen;
pkt->pktsize = pktsize + pktlen;
@@ -964,6 +971,7 @@ cdk_error_t cdk_pkt_read(cdk_stream_t inp, cdk_packet_t pkt)
break;
case CDK_PKT_USER_ID:
+
pkt->pkt.user_id = cdk_calloc(1, sizeof *pkt->pkt.user_id
+ pkt->pktlen + 1);
if (!pkt->pkt.user_id)