diff options
| author | Philip Withnall <withnall@endlessm.com> | 2018-08-16 20:12:02 +0100 |
|---|---|---|
| committer | Philip Withnall <withnall@endlessm.com> | 2018-10-23 17:01:51 +1300 |
| commit | eb7c9adc3b2570f6b82110b52a24609d124f38de (patch) | |
| tree | f2456bf338b8fa677417d84486dc9fe21c3f0594 /glib/gvariant-serialiser.c | |
| parent | da512adc34926d20bac929e51acefcb4d2c92a72 (diff) | |
| download | glib-eb7c9adc3b2570f6b82110b52a24609d124f38de.tar.gz | |
gvariant: Fix checking arithmetic for tuple element ends
When checking whether a serialised GVariant tuple is in normal form,
it’s possible for `offset_ptr -= offset_size` to underflow and wrap
around, resulting in gvs_read_unaligned_le() reading memory outside the
serialised GVariant bounds.
See §(Tuples) in gvariant-serialiser.c for the documentation on how
tuples are serialised. Briefly, all variable-length elements in the
tuple have an offset to their end stored in an array of offsets at the
end of the tuple. The width of each offset is in offset_size. offset_ptr
is added to the start of the serialised tuple to get the offset which is
currently being examined. The offset array is in reverse order compared
to the tuple elements, hence the subtraction.
The bug can be triggered if a tuple contains a load of variable-length
elements, each of whose length is actually zero (i.e. empty arrays).
Includes a unit test.
oss-fuzz#9801
Signed-off-by: Philip Withnall <withnall@endlessm.com>
Diffstat (limited to 'glib/gvariant-serialiser.c')
| -rw-r--r-- | glib/gvariant-serialiser.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/glib/gvariant-serialiser.c b/glib/gvariant-serialiser.c index 69f183121..96df54e23 100644 --- a/glib/gvariant-serialiser.c +++ b/glib/gvariant-serialiser.c @@ -1065,6 +1065,9 @@ gvs_tuple_is_normal (GVariantSerialised value) break; case G_VARIANT_MEMBER_ENDING_OFFSET: + if (offset_ptr < offset_size) + return FALSE; + offset_ptr -= offset_size; if (offset_ptr < offset) |