bug#64229: b2sum: heap-overflow in digest_check

["Pádraig Brady" <P@draigBrady.com>]

[-- Attachment #1: Type: text/plain, Size: 683 bytes --]

On 22/06/2023 17:33, Frank Busse wrote:
> Hi,
> 
> 
> KLEE reported a heap-overflow in b2sum (Coreutils 9.3). When running it
> with:
> 
> $ printf '\n\n0A0BA0' | coreutils-9.3/bin/b2sum -c
> 
> (even '0BA0' seems to work on my machine) ASAN confirms the issue:
> 
>> #1  0x0000000000473de0 in __interceptor_strchr (s=<optimized out>, c=<optimized out>)
>> #2  0x0000000000500a81 in digest_check (checkfile_name=0x7fffffffe69e "stdin") at /tmp/src/coreutils-9.3/src/digest.c:1216
>> #3  0x00000000005005e9 in main (argc=3, argv=0x7fffffffe3a8) at /tmp/src/coreutils-9.3/src/digest.c:1607

Nice one.
I'll push the attached later to fix this.

Marking this as done.

thanks,
Pádraig.

[-- Attachment #2: b2sum-uar-fix.patch --]
[-- Type: text/x-patch, Size: 2352 bytes --]

From bc5e3ab04c454c44b6c4d79b900c236cca35e9ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A1draig=20Brady?= <P@draigBrady.com>
Date: Thu, 22 Jun 2023 21:33:58 +0100
Subject: [PATCH] b2sum: fix UAR with --check with malformed checksum lines

* src/digest.c (split_3): Reinstate the check for whitespace after the
digest portion of the line, so that we exit early before inspecting
the file name which would be outside the passed buffer in the case
where the input does not contain a newline.
* tests/cksum/b2sum.sh: Add a test case.
* NEWS: Mention the bug fix.
Problem reported by Frank Busse using KLEE.
Fixes https://bugs.gnu.org/64229
---
 NEWS                 | 4 ++++
 src/digest.c         | 4 ++++
 tests/cksum/b2sum.sh | 5 +++++
 3 files changed, 13 insertions(+)

diff --git a/NEWS b/NEWS
index 3e2280777..3c134db52 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,10 @@ GNU coreutils NEWS                                    -*- outline -*-
   fail on files with inode numbers that do not fit into 32 bits.
   [This bug was present in "the beginning".]
 
+  'b2sum --check' will no longer read unallocated memory when
+  presented with malformed checksum lines.
+  [bug introduced in coreutils-9.2]
+
   'cp --parents' again succeeds when preserving mode for absolute directories.
   Previously it would have failed with a "No such file or directory" error.
   [bug introduced in coreutils-9.1]
diff --git a/src/digest.c b/src/digest.c
index ab32968db..851c7d118 100644
--- a/src/digest.c
+++ b/src/digest.c
@@ -862,6 +862,10 @@ split_3 (char *s, size_t s_len,
   while (s[i] && !ISWHITE (s[i]))
     i++;
 
+  /* The digest must be followed by at least one whitespace character.  */
+  if (i == s_len)
+    return false;
+
   *d_len = &s[i] - (char *) *digest;
   s[i++] = '\0';
 
diff --git a/tests/cksum/b2sum.sh b/tests/cksum/b2sum.sh
index 6a2d13024..7013b4972 100755
--- a/tests/cksum/b2sum.sh
+++ b/tests/cksum/b2sum.sh
@@ -61,6 +61,11 @@ printf '%s\n' 'BLAKE2' 'BLAKE2b' 'BLAKE2-' 'BLAKE2(' 'BLAKE2 (' > crash.check \
   || framework_failure_
 returns_ 1 $prog -c crash.check || fail=1
 
+# This would read unallocated memory from coreutils-9.2 to coreutils-9.3
+# which would trigger with ASAN or valgrind
+printf '0A0BA0' > overflow.check || framework_failure_
+returns_ 1 $prog -c overflow.check || fail=1
+
 done
 
 Exit $fail
-- 
2.40.1