Page MenuHomeFreeBSD
Differential D58822

db/hash: Harden hash(3) database code
Needs ReviewPublic
Actions

Authored by bnovkov on Thu, Aug 13, 11:12 AM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Aug 29, 10:48 PM
Unknown Object (File)
Sat, Aug 29, 10:36 PM
Unknown Object (File)
Sat, Aug 29, 6:35 PM
Unknown Object (File)
Mon, Aug 24, 10:02 AM
Unknown Object (File)
Mon, Aug 24, 7:13 AM
Unknown Object (File)
Mon, Aug 24, 6:27 AM
Unknown Object (File)
Sun, Aug 23, 3:10 PM
Unknown Object (File)
Sun, Aug 23, 2:32 AM
View All 18 Files
Subscribers
imp
kevans

Details

Reviewers
None
Group Reviewers
Klara
Summary

The hash(3) database code does not validate the on-disk database header,
leaving it open to several OOB read and write vulnerabilities.

This change adds basic header validation and array bounds checking to
parts of the hash(3) code that can be manipulated by messing with the
database header.

Sponsored by: Klara, Inc.
MFC after: 1 month

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 75559
Build 72442: arc lint + arc unit

Event Timeline

bnovkov created this revision.Thu, Aug 13, 11:12 AM
Herald added a subscriber: imp. · View Herald TranscriptThu, Aug 13, 11:12 AM
bnovkov requested review of this revision.Thu, Aug 13, 11:12 AM
Harbormaster completed remote builds in B75559: Diff 183976.Thu, Aug 13, 11:12 AM
kevans added a subscriber: kevans.Thu, Aug 13, 1:51 PM
kevans added inline comments.
lib/libc/db/hash/hash.c
161

This is also signed, are negative values not an issue?

bnovkov updated this revision to Diff 184039.Fri, Aug 14, 8:45 AM

Address @kevans 's comment

Harbormaster completed remote builds in B75584: Diff 184039.Fri, Aug 14, 8:45 AM
bnovkov marked an inline comment as done.Fri, Aug 14, 8:46 AM
bnovkov added inline comments.
lib/libc/db/hash/hash.c
161

Thanks for catching this, negative values here are an issue.

bnovkov updated this revision to Diff 185328.Fri, Aug 28, 10:12 AM
bnovkov marked an inline comment as done.

Propagate error from bounds checking instead of aborting

Harbormaster completed remote builds in B76275: Diff 185328.Fri, Aug 28, 10:13 AM

Revision Contents
Changeset List

PathSize
lib/
libc/
db/
hash/
47 lines
20 lines
15 lines
tests/
db/
3 lines
238 lines

Diff 183976

View Options

lib/libc/db/hash/hash.c

Loading...
View Options

lib/libc/db/hash/hash_buf.c

Loading...
View Options

lib/libc/db/hash/hash_page.c

Loading...
View Options

lib/libc/tests/db/Makefile

Loading...
View Options

lib/libc/tests/db/db_hash_tamper_test.c

Loading...