Git-Mirrors/RetroShare
1
0
Fork 0
mirror of https://github.com/RetroShare/RetroShare.git synced 2025-06-21 04:44:25 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

added check over recursive compression depth. Fixes CVE-2013-4402

Browse source 
git-svn-id: http://svn.code.sf.net/p/retroshare/code/trunk@6880 b45a01b8-16f6-495d-af2f-9b41ad6348cc
This commit is contained in:
csoler 2013-10-29 20:56:40 +00:00
parent 5304865fc4
commit 261d9102d4
2 changed files with 20 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

15
openpgpsdk/src/openpgpsdk/packet-parse.c
View file

@ -53,6 +53,7 @@
#include <openpgpsdk/final.h> #include <openpgpsdk/final.h>
static int debug=0; static int debug=0;
static const size_t MAX_RECURSIVE_COMPRESSION_DEPTH = 32 ;
/** /**
* limited_read_data reads the specified amount of the subregion's data * limited_read_data reads the specified amount of the subregion's data
@ -1955,9 +1956,17 @@ static int parse_compressed(ops_region_t *region,ops_parse_info_t *pinfo)
unsigned char c[1]=""; unsigned char c[1]="";
ops_parser_content_t content; ops_parser_content_t content;
if(pinfo->recursive_compression_depth > MAX_RECURSIVE_COMPRESSION_DEPTH)
{
fprintf(stderr,"Recursive compression down to depth 32. This is weird. Probably a packet crafted to crash PGP. Will be dropped!\n") ;
return 0 ;
}
if(!limited_read(c,1,region,pinfo)) if(!limited_read(c,1,region,pinfo))
return 0; return 0;
pinfo->recursive_compression_depth++ ;
C.compressed.type=c[0]; C.compressed.type=c[0];
CBP(pinfo,OPS_PTAG_CT_COMPRESSED,&content); CBP(pinfo,OPS_PTAG_CT_COMPRESSED,&content);
@ -1965,7 +1974,11 @@ static int parse_compressed(ops_region_t *region,ops_parse_info_t *pinfo)
/* The content of a compressed data packet is more OpenPGP packets /* The content of a compressed data packet is more OpenPGP packets
once decompressed, so recursively handle them */ once decompressed, so recursively handle them */
return ops_decompress(region,pinfo,C.compressed.type); int res = ops_decompress(region,pinfo,C.compressed.type);
pinfo->recursive_compression_depth-- ;
return res ;
} }
/** /**

1
openpgpsdk/src/openpgpsdk/parse_local.h
View file

@ -111,6 +111,7 @@ struct ops_parse_info
ops_crypt_t decrypt; ops_crypt_t decrypt;
ops_crypt_info_t cryptinfo; ops_crypt_info_t cryptinfo;
size_t nhashes; size_t nhashes;
size_t recursive_compression_depth ;
ops_parse_hash_info_t *hashes; ops_parse_hash_info_t *hashes;
ops_boolean_t reading_v3_secret:1; ops_boolean_t reading_v3_secret:1;
ops_boolean_t reading_mpi_length:1; ops_boolean_t reading_mpi_length:1;