!62 fix Integer overflow in ap_timeout_parameter_parse
From: @eaglegai Reviewed-by: @zengwefeng Signed-off-by: @zengwefeng
This commit is contained in:
openeuler-ci-bot
Gitee
commit
2e5ba1ef39
@ -0,0 +1,74 @@
|
|||||||
|
From 9226cbc6b92492615856b567ac7f7557f196634b Mon Sep 17 00:00:00 2001
|
||||||
|
From: Christophe Jaillet <jailletc36@apache.org>
|
||||||
|
Date: Tue, 10 Aug 2021 18:49:20 +0000
|
||||||
|
Subject: [PATCH] Follow up to 1892038, 1892063.
|
||||||
|
|
||||||
|
Improve fix to please a fuzzer which reports:
|
||||||
|
util.c:2713:26: runtime error: signed integer overflow:
|
||||||
|
9999999999999999 * 1000 cannot be represented in type 'long'
|
||||||
|
|
||||||
|
Compute the maximum limit for each case 's', 'h', 'ms' and 'mi' and make sure that the input is below this value.
|
||||||
|
|
||||||
|
While at it, move a comment to make things more consistent and use 'apr_time_from_msec() instead of hand writing it.
|
||||||
|
|
||||||
|
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1892185 13f79535-47bb-0310-9956-ffa450edef68
|
||||||
|
---
|
||||||
|
server/util.c | 16 ++++++++++------
|
||||||
|
1 file changed, 10 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/server/util.c b/server/util.c
|
||||||
|
index 4a35eac6b0c..d87417f7621 100644
|
||||||
|
--- a/server/util.c
|
||||||
|
+++ b/server/util.c
|
||||||
|
@@ -2668,6 +2668,7 @@ AP_DECLARE(char *) ap_append_pid(apr_pool_t *p, const char *string,
|
||||||
|
* in timeout_parameter.
|
||||||
|
* @return Status value indicating whether the parsing was successful or not.
|
||||||
|
*/
|
||||||
|
+#define CHECK_OVERFLOW(a, b) if (a > b) return APR_ERANGE
|
||||||
|
AP_DECLARE(apr_status_t) ap_timeout_parameter_parse(
|
||||||
|
const char *timeout_parameter,
|
||||||
|
apr_interval_time_t *timeout,
|
||||||
|
@@ -2697,10 +2698,12 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse(
|
||||||
|
switch (*time_str) {
|
||||||
|
/* Time is in seconds */
|
||||||
|
case 's':
|
||||||
|
+ CHECK_OVERFLOW(tout, apr_time_sec(APR_INT64_MAX));
|
||||||
|
check = apr_time_from_sec(tout);
|
||||||
|
break;
|
||||||
|
+ /* Time is in hours */
|
||||||
|
case 'h':
|
||||||
|
- /* Time is in hours */
|
||||||
|
+ CHECK_OVERFLOW(tout, apr_time_sec(APR_INT64_MAX / 3600));
|
||||||
|
check = apr_time_from_sec(tout * 3600);
|
||||||
|
break;
|
||||||
|
case 'm':
|
||||||
|
@@ -2710,10 +2713,12 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse(
|
||||||
|
switch (*(++time_str)) {
|
||||||
|
/* Time is in milliseconds */
|
||||||
|
case 's':
|
||||||
|
- check = tout * 1000;
|
||||||
|
+ CHECK_OVERFLOW(tout, apr_time_as_msec(APR_INT64_MAX));
|
||||||
|
+ check = apr_time_from_msec(tout);
|
||||||
|
break;
|
||||||
|
/* Time is in minutes */
|
||||||
|
case 'i':
|
||||||
|
+ CHECK_OVERFLOW(tout, apr_time_sec(APR_INT64_MAX / 60));
|
||||||
|
check = apr_time_from_sec(tout * 60);
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
@@ -2724,12 +2729,11 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse(
|
||||||
|
default:
|
||||||
|
return APR_EGENERAL;
|
||||||
|
}
|
||||||
|
- if (check > APR_INT64_MAX || check < 0) {
|
||||||
|
- return APR_ERANGE;
|
||||||
|
- }
|
||||||
|
- *timeout = (apr_interval_time_t) check;
|
||||||
|
+
|
||||||
|
+ *timeout = (apr_interval_time_t)check;
|
||||||
|
return APR_SUCCESS;
|
||||||
|
}
|
||||||
|
+#undef CHECK_OVERFLOW
|
||||||
|
|
||||||
|
AP_DECLARE(int) ap_parse_strict_length(apr_off_t *len, const char *str)
|
||||||
|
{
|
||||||
@ -0,0 +1,71 @@
|
|||||||
|
From 7ea44d0402334e40f31730d889c5ad60e158692d Mon Sep 17 00:00:00 2001
|
||||||
|
From: Eric Covener <covener@apache.org>
|
||||||
|
Date: Fri, 6 Aug 2021 13:10:45 +0000
|
||||||
|
Subject: [PATCH] fix int overflow in ap_timeout_parameter_parse
|
||||||
|
|
||||||
|
signed integer overflow in ap_timeout_parameter_parse under fuzzing
|
||||||
|
|
||||||
|
|
||||||
|
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1892038 13f79535-47bb-0310-9956-ffa450edef68
|
||||||
|
---
|
||||||
|
server/util.c | 17 +++++++++++++----
|
||||||
|
1 file changed, 13 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/server/util.c b/server/util.c
|
||||||
|
index 2d7708ae851..6f9dbd4d657 100644
|
||||||
|
--- a/server/util.c
|
||||||
|
+++ b/server/util.c
|
||||||
|
@@ -2676,6 +2676,7 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse(
|
||||||
|
char *endp;
|
||||||
|
const char *time_str;
|
||||||
|
apr_int64_t tout;
|
||||||
|
+ apr_uint64_t check;
|
||||||
|
|
||||||
|
tout = apr_strtoi64(timeout_parameter, &endp, 10);
|
||||||
|
if (errno) {
|
||||||
|
@@ -2688,14 +2689,18 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse(
|
||||||
|
time_str = endp;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (tout < 0) {
|
||||||
|
+ return APR_ERANGE;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
switch (*time_str) {
|
||||||
|
/* Time is in seconds */
|
||||||
|
case 's':
|
||||||
|
- *timeout = (apr_interval_time_t) apr_time_from_sec(tout);
|
||||||
|
+ check = apr_time_from_sec(tout);
|
||||||
|
break;
|
||||||
|
case 'h':
|
||||||
|
/* Time is in hours */
|
||||||
|
- *timeout = (apr_interval_time_t) apr_time_from_sec(tout * 3600);
|
||||||
|
+ check = apr_time_from_sec(tout * 3600);
|
||||||
|
break;
|
||||||
|
case 'm':
|
||||||
|
switch (*(++time_str)) {
|
||||||
|
@@ -2705,11 +2710,11 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse(
|
||||||
|
switch (*(++time_str)) {
|
||||||
|
/* Time is in milliseconds */
|
||||||
|
case 's':
|
||||||
|
- *timeout = (apr_interval_time_t) tout * 1000;
|
||||||
|
+ check = tout * 1000;
|
||||||
|
break;
|
||||||
|
/* Time is in minutes */
|
||||||
|
case 'i':
|
||||||
|
- *timeout = (apr_interval_time_t) apr_time_from_sec(tout * 60);
|
||||||
|
+ check = apr_time_from_sec(tout * 60);
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
return APR_EGENERAL;
|
||||||
|
@@ -2719,6 +2724,10 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse(
|
||||||
|
default:
|
||||||
|
return APR_EGENERAL;
|
||||||
|
}
|
||||||
|
+ if (check > APR_INT64_MAX || check < 0) {
|
||||||
|
+ return APR_ERANGE;
|
||||||
|
+ }
|
||||||
|
+ *timeout = (apr_interval_time_t) check;
|
||||||
|
return APR_SUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
11
httpd.spec
11
httpd.spec
@ -8,7 +8,7 @@
|
|||||||
Name: httpd
|
Name: httpd
|
||||||
Summary: Apache HTTP Server
|
Summary: Apache HTTP Server
|
||||||
Version: 2.4.48
|
Version: 2.4.48
|
||||||
Release: 3
|
Release: 4
|
||||||
License: ASL 2.0
|
License: ASL 2.0
|
||||||
URL: https://httpd.apache.org/
|
URL: https://httpd.apache.org/
|
||||||
Source0: https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2
|
Source0: https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2
|
||||||
@ -77,6 +77,8 @@ Patch24: backport-003-CVE-2021-40438.patch
|
|||||||
Patch25: backport-004-CVE-2021-40438.patch
|
Patch25: backport-004-CVE-2021-40438.patch
|
||||||
Patch26: backport-001-CVE-2021-39275.patch
|
Patch26: backport-001-CVE-2021-39275.patch
|
||||||
Patch27: backport-002-CVE-2021-39275.patch
|
Patch27: backport-002-CVE-2021-39275.patch
|
||||||
|
Patch28: backport-fix-int-overflow-in-ap_timeout_parameter_parse.patch
|
||||||
|
Patch29: backport-Improve-fix-to-please-a-fuzzer-which-reports-overflow.patch
|
||||||
|
|
||||||
BuildRequires: gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel
|
BuildRequires: gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel
|
||||||
BuildRequires: zlib-devel libselinux-devel lua-devel brotli-devel
|
BuildRequires: zlib-devel libselinux-devel lua-devel brotli-devel
|
||||||
@ -509,6 +511,13 @@ exit $rv
|
|||||||
%{_rpmconfigdir}/macros.d/macros.httpd
|
%{_rpmconfigdir}/macros.d/macros.httpd
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Nov 05 2021 gaihuiying <gaihuiying1@huawei.com> - 2.4.48-4
|
||||||
|
- Type:bugfix
|
||||||
|
- ID:NA
|
||||||
|
- SUG:restart
|
||||||
|
- DESC:fix int overflow in ap_timeout_parameter_parse
|
||||||
|
Improve fix to please a fuzzer int overflow
|
||||||
|
|
||||||
* Wed Sep 29 2021 gaihuiying <gaihuiying1@huawei.com> - 2.4.48-3
|
* Wed Sep 29 2021 gaihuiying <gaihuiying1@huawei.com> - 2.4.48-3
|
||||||
- Type:cves
|
- Type:cves
|
||||||
- ID:CVE-2021-40438 CVE-2021-39275
|
- ID:CVE-2021-40438 CVE-2021-39275
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user