[SSSD] [PATCH] CRYPTO: Fix access to uninitialized data

Lukas Slebodnik lslebodn at redhat.com
Thu Apr 17 06:57:54 UTC 2014


ehlo,

The size of output buffer(obufsize) was longer than initialised data.
In calculation, uint32_t was used for length of the cryptotext,
but uint16_t was written into buffer. The end of buffer was not initialised
and it caused valgrind warning.

 Use of uninitialised value of size 8
    at 0x37AE40F363: pl_base64_encode_buffer (nssb64e.c:180)
    by 0x37AE40F6ED: NSSBase64_EncodeItem_Util (nssb64e.c:482)
    by 0x37AE40F87A: BTOA_DataToAscii_Util (nssb64e.c:721)
    by 0x40208A: sss_base64_encode (nss_base64.c:47)
    by 0x403305: sss_password_encrypt (nss_obfuscate.c:358)

The easiest reproducer is the crypto-test.
CK_FORK=no libtool --mode=execute valgrind ./crypto-tests

LS
-------------- next part --------------
>From 00f080711268af85b9881e40a6961cae7eb8b26e Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Tue, 18 Mar 2014 18:29:43 +0100
Subject: [PATCH] CRYPTO: Fix access to uninitialized data

The size of output buffer(obufsize) was longer than initialised data.
In calculation, uint32_t was used for length of the cryptotext,
but uint16_t was written into buffer. The end of buffer was not initialised
and it caused valgrind warning.

 Use of uninitialised value of size 8
    at 0x37AE40F363: pl_base64_encode_buffer (nssb64e.c:180)
    by 0x37AE40F6ED: NSSBase64_EncodeItem_Util (nssb64e.c:482)
    by 0x37AE40F87A: BTOA_DataToAscii_Util (nssb64e.c:721)
    by 0x40208A: sss_base64_encode (nss_base64.c:47)
    by 0x403305: sss_password_encrypt (nss_obfuscate.c:358)
---
 src/util/crypto/libcrypto/crypto_obfuscate.c | 8 ++++++--
 src/util/crypto/nss/nss_obfuscate.c          | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/util/crypto/libcrypto/crypto_obfuscate.c b/src/util/crypto/libcrypto/crypto_obfuscate.c
index 50ea469c83b7f7aeb8ffe98c1b6e864292a6822f..85de333ec64ec97bebff932465136f655579e8fc 100644
--- a/src/util/crypto/libcrypto/crypto_obfuscate.c
+++ b/src/util/crypto/libcrypto/crypto_obfuscate.c
@@ -141,17 +141,21 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen,
     }
 
     result_len = ctlen + digestlen;
+    if (result_len < 0 || result_len > UINT16_MAX) {
+        ret = ERANGE;
+        goto done;
+    }
 
     /* Pack the obfuscation buffer */
     /* The buffer consists of:
      * uint16_t      the type of the cipher
-     * uint32_t      length of the cryptotext in bytes (clen)
+     * uint16_t      length of the cryptotext in bytes (clen)
      * uint8_t[klen] key
      * uint8_t[blen] IV
      * uint8_t[clen] cryptotext
      * 4 bytes of "sentinel" denoting end of the buffer
      */
-    obufsize = sizeof(uint16_t) + sizeof(uint32_t) +
+    obufsize = sizeof(uint16_t) + sizeof(uint16_t) +
                mech_props->keylen + mech_props->bsize +
                result_len + OBF_BUFFER_SENTINEL_SIZE;
     obfbuf = talloc_array(tmp_ctx, unsigned char, obufsize);
diff --git a/src/util/crypto/nss/nss_obfuscate.c b/src/util/crypto/nss/nss_obfuscate.c
index fc052ec976c9a951e30dcdb7fff8f11fd8a1cf1f..8c6bdc52524ad7f7a491603e9fd2902fdf9eed18 100644
--- a/src/util/crypto/nss/nss_obfuscate.c
+++ b/src/util/crypto/nss/nss_obfuscate.c
@@ -325,17 +325,21 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen,
         goto done;
     }
     result_len = ctlen + digestlen;
+    if (result_len < 0 || result_len > UINT16_MAX) {
+        ret = ERANGE;
+        goto done;
+    }
 
     /* Pack the obfuscation buffer */
     /* The buffer consists of:
      * uint16_t      the type of the cipher
-     * uint32_t      length of the cryptotext in bytes (clen)
+     * uint16_t      length of the cryptotext in bytes (clen)
      * uint8_t[klen] key
      * uint8_t[blen] IV
      * uint8_t[clen] cryptotext
      * 4 bytes of "sentinel" denoting end of the buffer
      */
-    obufsize = sizeof(uint16_t) + sizeof(uint32_t) +
+    obufsize = sizeof(uint16_t) + sizeof(uint16_t) +
                mech_props->keylen + mech_props->bsize +
                result_len + OBF_BUFFER_SENTINEL_SIZE;
     obfbuf = talloc_array(tmp_ctx, unsigned char, obufsize);
-- 
1.9.0



More information about the sssd-devel mailing list