!13 修改oss-fuzz memory leak问题
From: @disnight Reviewed-by: @solarhu,@small_leek Signed-off-by: @small_leek
This commit is contained in:
openeuler-ci-bot
Gitee
commit
dfcfc88280
@ -0,0 +1,35 @@
|
||||
From 77a5b8bf749d059ed3966dc7b6c4a67d265fc69b Mon Sep 17 00:00:00 2001
|
||||
From: esaunders <esaunders@basistech.com>
|
||||
Date: Tue, 3 Dec 2019 17:28:38 -0500
|
||||
Subject: [PATCH 2/2] Ensure that we don't attempt to index into an invalid
|
||||
offset in imap_buf.
|
||||
|
||||
---
|
||||
tsk/fs/ext2fs.c | 13 +++++++++++++
|
||||
1 file changed, 13 insertions(+)
|
||||
|
||||
diff --git a/tsk/fs/ext2fs.c b/tsk/fs/ext2fs.c
|
||||
index 5a480856..14715c11 100755
|
||||
--- a/tsk/fs/ext2fs.c
|
||||
+++ b/tsk/fs/ext2fs.c
|
||||
@@ -1051,6 +1051,19 @@ ext2fs_inode_walk(TSK_FS_INFO * fs, TSK_INUM_T start_inum,
|
||||
grp_num * tsk_getu32(fs->endian,
|
||||
ext2fs->fs->s_inodes_per_group) + 1;
|
||||
|
||||
+ /*
|
||||
+ * Ensure that inum - ibase refers to a valid offset in imap_buf.
|
||||
+ */
|
||||
+ if ((inum - ibase) > fs->block_size) {
|
||||
+ tsk_release_lock(&ext2fs->lock);
|
||||
+ free(dino_buf);
|
||||
+ tsk_error_reset();
|
||||
+ tsk_error_set_errno(TSK_ERR_FS_WALK_RNG);
|
||||
+ tsk_error_set_errstr("%s: Invalid offset into imap_buf (inum %" PRIuINUM " - ibase %" PRIuINUM ")",
|
||||
+ myname, inum, ibase);
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
/*
|
||||
* Apply the allocated/unallocated restriction.
|
||||
*/
|
||||
--
|
||||
47
0003-Fix-bug-introduced-with-imap-offset-check.patch
Normal file
47
0003-Fix-bug-introduced-with-imap-offset-check.patch
Normal file
@ -0,0 +1,47 @@
|
||||
From f7a20cf162a02a4ce5301eb6b27bbc53fd5998b5 Mon Sep 17 00:00:00 2001
|
||||
From: Brian Carrier <carrier@sleuthkit.org>
|
||||
Date: Wed, 29 Apr 2020 15:47:01 -0400
|
||||
Subject: [PATCH] Fix bug introduced with imap offset check
|
||||
|
||||
---
|
||||
tsk/fs/ext2fs.c | 18 ++++++++++++++++--
|
||||
1 file changed, 16 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/tsk/fs/ext2fs.c b/tsk/fs/ext2fs.c
|
||||
index 45dd18c2..1f56c943 100755
|
||||
--- a/tsk/fs/ext2fs.c
|
||||
+++ b/tsk/fs/ext2fs.c
|
||||
@@ -841,6 +841,20 @@ ext2fs_dinode_copy(EXT2FS_INFO * ext2fs, TSK_FS_META * fs_meta,
|
||||
grp_num * tsk_getu32(fs->endian,
|
||||
ext2fs->fs->s_inodes_per_group) + fs->first_inum;
|
||||
|
||||
+
|
||||
+ /*
|
||||
+ * Ensure that inum - ibase refers to a valid bit offset in imap_buf.
|
||||
+ */
|
||||
+ if ((inum - ibase) > fs->block_size*8) {
|
||||
+ tsk_release_lock(&ext2fs->lock);
|
||||
+ tsk_error_reset();
|
||||
+ tsk_error_set_errno(TSK_ERR_FS_WALK_RNG);
|
||||
+ tsk_error_set_errstr("ext2fs_dinode_copy: Invalid offset into imap_buf (inum %" PRIuINUM " - ibase %" PRIuINUM ")",
|
||||
+ inum, ibase);
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
+
|
||||
/*
|
||||
* Apply the allocated/unallocated restriction.
|
||||
*/
|
||||
@@ -1052,9 +1066,9 @@ ext2fs_inode_walk(TSK_FS_INFO * fs, TSK_INUM_T start_inum,
|
||||
ext2fs->fs->s_inodes_per_group) + 1;
|
||||
|
||||
/*
|
||||
- * Ensure that inum - ibase refers to a valid offset in imap_buf.
|
||||
+ * Ensure that inum - ibase refers to a valid bit offset in imap_buf.
|
||||
*/
|
||||
- if ((inum - ibase) > fs->block_size) {
|
||||
+ if ((inum - ibase) > fs->block_size*8) {
|
||||
tsk_release_lock(&ext2fs->lock);
|
||||
free(dino_buf);
|
||||
tsk_error_reset();
|
||||
--
|
||||
@ -0,0 +1,24 @@
|
||||
From 109ca428154925f6e031fbc817b48e9dc578f8db Mon Sep 17 00:00:00 2001
|
||||
From: esaunders <esaunders@basistech.com>
|
||||
Date: Tue, 14 Jan 2020 15:45:44 -0500
|
||||
Subject: [PATCH] Cast attrseq address to uintptr_t so that the correct type
|
||||
can be inferred for the + operator.
|
||||
|
||||
---
|
||||
tsk/fs/ntfs.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/tsk/fs/ntfs.c b/tsk/fs/ntfs.c
|
||||
index 837033ea..eeff809e 100755
|
||||
--- a/tsk/fs/ntfs.c
|
||||
+++ b/tsk/fs/ntfs.c
|
||||
@@ -1770,7 +1770,7 @@ ntfs_proc_attrseq(NTFS_INFO * ntfs,
|
||||
// sanity check on bounds of attribute. Prevents other
|
||||
// issues later on that use attr->len for bounds checks.
|
||||
if (((uintptr_t) attr + tsk_getu32(fs->endian,
|
||||
- attr->len)) > (uintptr_t) (a_attrseq + len)) {
|
||||
+ attr->len)) > (uintptr_t)a_attrseq + len) {
|
||||
break;
|
||||
}
|
||||
|
||||
--
|
||||
62
0005-Fix-Fuzz-buffer-overflow.patch
Normal file
62
0005-Fix-Fuzz-buffer-overflow.patch
Normal file
@ -0,0 +1,62 @@
|
||||
diff -Nur sleuthkit-4.6.7/tsk/fs/ext2fs.c sleuthkit-4.6.7.new/tsk/fs/ext2fs.c
|
||||
--- sleuthkit-4.6.7/tsk/fs/ext2fs.c 2020-12-16 14:43:46.929902964 +0800
|
||||
+++ sleuthkit-4.6.7.new/tsk/fs/ext2fs.c 2020-12-16 14:54:44.211056190 +0800
|
||||
@@ -1021,8 +1021,10 @@
|
||||
if ((fs_file = tsk_fs_file_alloc(fs)) == NULL)
|
||||
return 1;
|
||||
if ((fs_file->meta =
|
||||
- tsk_fs_meta_alloc(EXT2FS_FILE_CONTENT_LEN)) == NULL)
|
||||
+ tsk_fs_meta_alloc(EXT2FS_FILE_CONTENT_LEN)) == NULL) {
|
||||
+ tsk_fs_file_close(fs_file);
|
||||
return 1;
|
||||
+ }
|
||||
|
||||
// we need to handle fs->last_inum specially because it is for the
|
||||
// virtual ORPHANS directory. Handle it outside of the loop.
|
||||
@@ -1038,6 +1040,7 @@
|
||||
ext2fs->inode_size >
|
||||
sizeof(ext2fs_inode) ? ext2fs->inode_size : sizeof(ext2fs_inode);
|
||||
if ((dino_buf = (ext2fs_inode *) tsk_malloc(size)) == NULL) {
|
||||
+ tsk_fs_file_close(fs_file);
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -1058,6 +1061,7 @@
|
||||
|
||||
if (ext2fs_imap_load(ext2fs, grp_num)) {
|
||||
tsk_release_lock(&ext2fs->lock);
|
||||
+ tsk_fs_file_close(fs_file);
|
||||
free(dino_buf);
|
||||
return 1;
|
||||
}
|
||||
@@ -1068,8 +1072,9 @@
|
||||
/*
|
||||
* Ensure that inum - ibase refers to a valid bit offset in imap_buf.
|
||||
*/
|
||||
- if ((inum - ibase) > fs->block_size*8) {
|
||||
+ if ((inum - ibase) >= fs->block_size*8) {
|
||||
tsk_release_lock(&ext2fs->lock);
|
||||
+ tsk_fs_file_close(fs_file);
|
||||
free(dino_buf);
|
||||
tsk_error_reset();
|
||||
tsk_error_set_errno(TSK_ERR_FS_WALK_RNG);
|
||||
@@ -1120,7 +1125,7 @@
|
||||
* to the application.
|
||||
*/
|
||||
if (ext2fs_dinode_copy(ext2fs, fs_file->meta, inum, dino_buf)) {
|
||||
- tsk_fs_meta_close(fs_file->meta);
|
||||
+ tsk_fs_file_close(fs_file);
|
||||
free(dino_buf);
|
||||
return 1;
|
||||
}
|
||||
diff -Nur sleuthkit-4.6.7/tsk/fs/unix_misc.c sleuthkit-4.6.7.new/tsk/fs/unix_misc.c
|
||||
--- sleuthkit-4.6.7/tsk/fs/unix_misc.c 2019-08-03 04:20:57.000000000 +0800
|
||||
+++ sleuthkit-4.6.7.new/tsk/fs/unix_misc.c 2020-12-16 14:56:46.852764086 +0800
|
||||
@@ -180,6 +180,7 @@
|
||||
}
|
||||
tsk_error_set_errstr2("unix_make_data_run_indir: Block %"
|
||||
PRIuDADDR, addr);
|
||||
+ free(data_run);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
@ -1,12 +1,16 @@
|
||||
Name: sleuthkit
|
||||
Version: 4.6.7
|
||||
Release: 3
|
||||
Release: 4
|
||||
Summary: Tools for file system and volume forensic analysis
|
||||
License: CPL and IBM and GPLv2+
|
||||
URL: http://www.sleuthkit.org
|
||||
Source0: https://github.com/sleuthkit/sleuthkit/releases/download/sleuthkit-%{version}/sleuthkit-%{version}.tar.gz
|
||||
|
||||
Patch1: 0001-MEMORYLEAK-DOS-LOAD-EXT-TABLE.patch
|
||||
Patch2: 0002-Ensure-that-we-don-t-attempt-to-index-into-an-invali.patch
|
||||
Patch3: 0003-Fix-bug-introduced-with-imap-offset-check.patch
|
||||
Patch4: 0004-Cast-attrseq-address-to-uintptr_t-so-that-the-correc.patch
|
||||
Patch5: 0005-Fix-Fuzz-buffer-overflow.patch
|
||||
|
||||
BuildRequires: gcc-c++ afflib-devel >= 3.3.4 libewf-devel perl-generators sqlite-devel
|
||||
|
||||
@ -81,6 +85,12 @@ sed -i.rpath 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
|
||||
%{_mandir}/man1/*
|
||||
|
||||
%changelog
|
||||
* Tue Dec 15 2020 Jiachen Fan <fanjiachen3@huawei.com> - 4.6.7-4
|
||||
- fix oss-fuzz heap over flow
|
||||
|
||||
* Wed Dec 9 2020 Jiachen Fan <fanjiachen3@huawei.com> - 4.6.7-3
|
||||
- fix oss-fuzz memory leak
|
||||
|
||||
* Fri Feb 21 2020 wangzhishun <wangzhishun1@huawei.com> - 4.6.7-2
|
||||
- Package init
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user