packages/squashfs-tools
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
squashfs-tools/0005-CVE-2021-40153.patch
markeryang 3c1478d7b7 Fix CVE-2021-40153 CVE-2021-41072
2021-11-09 20:42:27 +08:00

265 lines
9.3 KiB
Diff
Raw Blame History

From 39971ca17a17520cefeb84f65e028d5004a579b2 Mon Sep 17 00:00:00 2001
From: Phillip Lougher <phillip@squashfs.org.uk>
Date: Sat, 16 Jan 2021 20:08:55 +0000
Subject: [PATCH] Unsquashfs: fix write outside destination directory exploit
An issue on Github (https://github.com/plougher/squashfs-tools/issues/72)
shows how some specially crafted Squashfs filesystems containing
invalid file names (with '/' and ..) can cause Unsquashfs to write
files outside of the destination directory.
This commit fixes this exploit by checking all names for
validity.
In doing so I have also added checks for '.' and for names that
are shorter than they should be (names in the file system should
not have '\0' terminators).
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
---
squashfs-tools/Makefile | 5 ++-
squashfs-tools/unsquash-1.c | 9 +++++-
squashfs-tools/unsquash-1234.c | 58 ++++++++++++++++++++++++++++++++++
squashfs-tools/unsquash-2.c | 9 +++++-
squashfs-tools/unsquash-3.c | 9 +++++-
squashfs-tools/unsquash-4.c | 9 +++++-
squashfs-tools/unsquashfs.c | 4 +--
squashfs-tools/unsquashfs.h | 5 ++-
8 files changed, 100 insertions(+), 8 deletions(-)
create mode 100644 squashfs-tools/unsquash-1234.c
diff --git a/squashfs-tools/Makefile b/squashfs-tools/Makefile
index 46c0772..de06bb2 100644
--- a/squashfs-tools/Makefile
+++ b/squashfs-tools/Makefile
@@ -156,7 +156,8 @@ MKSQUASHFS_OBJS = mksquashfs.o read_fs.o action.o swap.o pseudo.o compressor.o \
caches-queues-lists.o
UNSQUASHFS_OBJS = unsquashfs.o unsquash-1.o unsquash-2.o unsquash-3.o \
- unsquash-4.o unsquash-123.o unsquash-34.o swap.o compressor.o unsquashfs_info.o
+ unsquash-4.o unsquash-123.o unsquash-34.o unsquash-1234.o swap.o \
+ compressor.o unsquashfs_info.o
CFLAGS ?= -O2
CFLAGS += $(EXTRA_CFLAGS) $(INCLUDEDIR) -D_FILE_OFFSET_BITS=64 \
@@ -350,6 +351,8 @@ unsquash-123.o: unsquashfs.h unsquash-123.c squashfs_fs.h squashfs_compat.h
unsquash-34.o: unsquashfs.h unsquash-34.c
+unsquash-1234.o: unsquash-1234.c
+
unsquashfs_xattr.o: unsquashfs_xattr.c unsquashfs.h squashfs_fs.h xattr.h
unsquashfs_info.o: unsquashfs.h squashfs_fs.h
diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c
index 34eced3..28326cb 100644
--- a/squashfs-tools/unsquash-1.c
+++ b/squashfs-tools/unsquash-1.c
@@ -2,7 +2,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2011, 2012, 2019
+ * Copyright (c) 2009, 2010, 2011, 2012, 2019, 2021
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -285,6 +285,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse
memcpy(dire->name, directory_table + bytes,
dire->size + 1);
dire->name[dire->size + 1] = '\0';
+
+ /* check name for invalid characters (i.e /, ., ..) */
+ if(check_name(dire->name, dire->size + 1) == FALSE) {
+ ERROR("File system corrupted: invalid characters in name\n");
+ goto corrupted;
+ }
+
TRACE("squashfs_opendir: directory entry %s, inode "
"%d:%d, type %d\n", dire->name,
dirh.start_block, dire->offset, dire->type);
diff --git a/squashfs-tools/unsquash-1234.c b/squashfs-tools/unsquash-1234.c
new file mode 100644
index 0000000..c2d4f42
--- /dev/null
+++ b/squashfs-tools/unsquash-1234.c
@@ -0,0 +1,58 @@
+/*
+ * Unsquash a squashfs filesystem. This is a highly compressed read only
+ * filesystem.
+ *
+ * Copyright (c) 2021
+ * Phillip Lougher <phillip@squashfs.org.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2,
+ * or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * unsquash-1234.c
+ *
+ * Helper functions used by unsquash-1, unsquash-2, unsquash-3 and
+ * unsquash-4.
+ */
+
+#define TRUE 1
+#define FALSE 0
+/*
+ * Check name for validity, name should not
+ * - be ".", "./", or
+ * - be "..", "../" or
+ * - have a "/" anywhere in the name, or
+ * - be shorter than the expected size
+ */
+int check_name(char *name, int size)
+{
+ char *start = name;
+
+ if(name[0] == '.') {
+ if(name[1] == '.')
+ name++;
+ if(name[1] == '/' || name[1] == '\0')
+ return FALSE;
+ }
+
+ while(name[0] != '/' && name[0] != '\0')
+ name ++;
+
+ if(name[0] == '/')
+ return FALSE;
+
+ if((name - start) != size)
+ return FALSE;
+
+ return TRUE;
+}
diff --git a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c
index 4b3d767..474064e 100644
--- a/squashfs-tools/unsquash-2.c
+++ b/squashfs-tools/unsquash-2.c
@@ -2,7 +2,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2013, 2019
+ * Copyright (c) 2009, 2010, 2013, 2019, 2021
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -386,6 +386,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse
memcpy(dire->name, directory_table + bytes,
dire->size + 1);
dire->name[dire->size + 1] = '\0';
+
+ /* check name for invalid characters (i.e /, ., ..) */
+ if(check_name(dire->name, dire->size + 1) == FALSE) {
+ ERROR("File system corrupted: invalid characters in name\n");
+ goto corrupted;
+ }
+
TRACE("squashfs_opendir: directory entry %s, inode "
"%d:%d, type %d\n", dire->name,
dirh.start_block, dire->offset, dire->type);
diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c
index 02c31fc..65cfe4d 100644
--- a/squashfs-tools/unsquash-3.c
+++ b/squashfs-tools/unsquash-3.c
@@ -2,7 +2,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019
+ * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019, 2021
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -413,6 +413,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse
memcpy(dire->name, directory_table + bytes,
dire->size + 1);
dire->name[dire->size + 1] = '\0';
+
+ /* check name for invalid characters (i.e /, ., ..) */
+ if(check_name(dire->name, dire->size + 1) == FALSE) {
+ ERROR("File system corrupted: invalid characters in name\n");
+ goto corrupted;
+ }
+
TRACE("squashfs_opendir: directory entry %s, inode "
"%d:%d, type %d\n", dire->name,
dirh.start_block, dire->offset, dire->type);
diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
index 8475835..aa23a84 100644
--- a/squashfs-tools/unsquash-4.c
+++ b/squashfs-tools/unsquash-4.c
@@ -2,7 +2,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019
+ * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019, 2021
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -349,6 +349,13 @@ static struct dir *squashfs_opendir(unsigned int block_start, unsigned int offse
memcpy(dire->name, directory_table + bytes,
dire->size + 1);
dire->name[dire->size + 1] = '\0';
+
+ /* check name for invalid characters (i.e /, ., ..) */
+ if(check_name(dire->name, dire->size + 1) == FALSE) {
+ ERROR("File system corrupted: invalid characters in name\n");
+ goto corrupted;
+ }
+
TRACE("squashfs_opendir: directory entry %s, inode "
"%d:%d, type %d\n", dire->name,
dirh.start_block, dire->offset, dire->type);
diff --git a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c
index 727f1d5..f1c3552 100644
--- a/squashfs-tools/unsquashfs.c
+++ b/squashfs-tools/unsquashfs.c
@@ -2610,8 +2610,8 @@ int parse_number(char *start, int *res)
#define VERSION() \
- printf("unsquashfs version 4.4 (2019/08/29)\n");\
- printf("copyright (C) 2019 Phillip Lougher "\
+ printf("unsquashfs version 4.4-git (2021/01/17)\n");\
+ printf("copyright (C) 2021 Phillip Lougher "\
"<phillip@squashfs.org.uk>\n\n");\
printf("This program is free software; you can redistribute it and/or"\
"\n");\
diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
index 934618b..db1da7a 100644
--- a/squashfs-tools/unsquashfs.h
+++ b/squashfs-tools/unsquashfs.h
@@ -4,7 +4,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2013, 2014, 2019
+ * Copyright (c) 2009, 2010, 2013, 2014, 2019, 2021
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -261,4 +261,7 @@ extern int read_ids(int, long long, long long, unsigned int **);
/* unsquash-34.c */
extern long long *alloc_index_table(int);
+
+/* unsquash-1234.c */
+extern int check_name(char *, int);
#endif
--
2.23.0
Reference in New Issue View Git Blame Copy Permalink