Page MenuHomeFreeBSD
Files F164873137

D56510.id175853.diff
No OneTemporary
Actions

D56510.id175853.diff
View Options

diff --git a/contrib/openbsm/bsm/libbsm.h b/contrib/openbsm/bsm/libbsm.h
--- a/contrib/openbsm/bsm/libbsm.h
+++ b/contrib/openbsm/bsm/libbsm.h
@@ -585,13 +585,19 @@
u_int32_t addr;
} au_socketinet32_t;
+/*
+ * Largest sun_path across all supported platforms (Linux and Solaris use 108,
+ * macOS and FreeBSD use 104).
+ */
+#define AU_UNIX_PATH_MAX 108
+
/*
* socket family 2 bytes
- * path 104 bytes
+ * path up to AU_UNIX_PATH_MAX bytes (NUL terminated)
*/
typedef struct {
u_int16_t family;
- char path[104];
+ char path[AU_UNIX_PATH_MAX];
} au_socketunix_t;
/*
diff --git a/contrib/openbsm/libbsm/bsm_io.c b/contrib/openbsm/libbsm/bsm_io.c
--- a/contrib/openbsm/libbsm/bsm_io.c
+++ b/contrib/openbsm/libbsm/bsm_io.c
@@ -1867,6 +1867,15 @@
return (-1);
for (i = 0; i < tok->tt.execarg.count; i++) {
+ /*
+ * Make sure that tok->len has not reached the end of the
+ * buffer. If the previous string's nul byte was the last byte
+ * in the buffer, the nul accounting below will have set
+ * tok->len == len, leaving no room for another string.
+ */
+ if (tok->len >= (u_int32_t)len) {
+ return (-1);
+ }
bptr = buf + tok->len;
if (i < AUDIT_MAX_ARGS)
tok->tt.execarg.text[i] = (char*)bptr;
@@ -1925,6 +1934,15 @@
return (-1);
for (i = 0; i < tok->tt.execenv.count; i++) {
+ /*
+ * Make sure that tok->len has not reached the end of the
+ * buffer. If the previous string's nul byte was the last byte
+ * in the buffer, the nul accounting below will have set
+ * tok->len == len, leaving no room for another string.
+ */
+ if (tok->len >= (u_int32_t)len) {
+ return (-1);
+ }
bptr = buf + tok->len;
if (i < AUDIT_MAX_ENV)
tok->tt.execenv.text[i] = (char*)bptr;
@@ -2037,6 +2055,17 @@
if (err)
return (-1);
+ /*
+ * grps.list[] is statically sized and set to AUDIT_MAX_GROUPS. If the
+ * group count specified in the record is greater than this value just
+ * clamp/truncate it. Silently truncating a malformed record changes
+ * what was recorded and could mask tampering. However, a precedent
+ * has been set in fetch_execarg_tok and fetch_execenv_tok which
+ * truncate the count under similar circumstances.
+ */
+ if (tok->tt.grps.no > AUDIT_MAX_GROUPS) {
+ tok->tt.grps.no = AUDIT_MAX_GROUPS;
+ }
for (i = 0; i<tok->tt.grps.no; i++) {
READ_TOKEN_U_INT32(buf, len, tok->tt.grps.list[i], tok->len,
err);
@@ -3197,27 +3226,36 @@
/*
* socket family 2 bytes
- * path (up to) 104 bytes + NULL (NULL terminated string).
+ * path (up to) AU_UNIX_PATH_MAX bytes (NUL terminated)
*/
static int
fetch_sock_unix_tok(tokenstr_t *tok, u_char *buf, int len)
{
+ size_t remaining, search, pathmax;
int err = 0;
u_char *p;
int slen;
-
READ_TOKEN_U_INT16(buf, len, tok->tt.sockunix.family, tok->len, err);
if (err)
return (-1);
- /* slen = strnlen((buf + tok->len), 104) + 1; */
- p = (u_char *)memchr((const void *)(buf + tok->len), '\0', 104);
- slen = (p ? (int)(p - (buf + tok->len)) : 104) + 1;
+ /*
+ * Clamp the search to the bytes remaining in the token and the path
+ * storage size. Using sizeof(tok->tt.sockunix.path) rather than a
+ * literal keeps the bound in sync with au_socketunix_t automatically.
+ */
+ pathmax = sizeof(tok->tt.sockunix.path);
+ remaining = (size_t)(len - (int)tok->len);
+ search = remaining < pathmax ? remaining : pathmax;
+ p = (u_char *)memchr((const void *)(buf + tok->len), '\0', search);
+ slen = (p ? (int)(p - (buf + tok->len)) + 1 : (int)search);
READ_TOKEN_BYTES(buf, len, tok->tt.sockunix.path, slen, tok->len, err);
if (err)
return (-1);
+ /* guarantee NUL termination when no NUL was found in the token data */
+ tok->tt.sockunix.path[pathmax - 1] = '\0';
return (0);
}
@@ -3278,7 +3316,7 @@
if (err)
return (-1);
- READ_TOKEN_BYTES(buf, len, &tok->tt.socket.l_addr,
+ READ_TOKEN_BYTES(buf, len, &tok->tt.socket.r_addr,
sizeof(tok->tt.socket.r_addr), tok->len, err);
if (err)
return (-1);
diff --git a/contrib/openbsm/libbsm/bsm_token.c b/contrib/openbsm/libbsm/bsm_token.c
--- a/contrib/openbsm/libbsm/bsm_token.c
+++ b/contrib/openbsm/libbsm/bsm_token.c
@@ -1051,7 +1051,7 @@
/*
* token ID 1 byte
* socket family 2 bytes
- * path (up to) 104 bytes + NULL (NULL terminated string)
+ * path (up to) AU_UNIX_PATH_MAX bytes (NUL terminated)
*/
token_t *
au_to_sock_unix(struct sockaddr_un *so)

File Metadata

Mime Type
text/plain
Expires
Wed, Aug 5, 9:54 AM (6 m, 38 s)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
36031579
Default Alt Text
D56510.id175853.diff (4 KB)

Event Timeline