Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 May 2017 13:41:32 +0200
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: Marc Lehmann <schmorp@...morp.de>, oss-security <oss-security@...ts.openwall.com>
Cc: rxvt-unicode@...morp.de, "jer@...too.org" <jer@...too.org>
Subject: Defense in depth patch for rxvt-unicode

Hello list,

This email thread concerns my request to Marc to include the attached
patch inside rxvt-unicode upstream. My own downstream -- Gentoo's
jer@, also CCd -- won't include the patch until the agreement of
upstream. Thus, it's important we come to a good conclusion.

On Wed, May 17, 2017 at 3:17 AM, Marc Lehmann <schmorp@...morp.de> wrote:
> On Fri, May 12, 2017 at 02:18:29PM +0200, "Jason A. Donenfeld" <zx2c4@...too.org> wrote:
>> I realize I might have used the wrong email address, so please see the
>> thread below.
>
> You used the right address, but since I was quite busy, and your mail
> contained nothing but a patch that might break valid uses without any
> explanation of what it might be useful for, I didn't immediately know what
> to reply and it fell through the cracks.

Hi Marc,

This patch was part of a larger discussion on which you were CCd from
distros. It seems possible that either those messages didn't make it
to you, or you didn't have time to read them.

In any case, the attached patch would be a useful defense in depth
measure to prevent future integer overflow bugs, such as the one that
was recently found in rxvt. Briefly looking though the code, it seems
like there is a considerable amount of unchecked integer arithmetic,
often passing between several functions in several files. Short of
somehow auditing every arithmetic call path, a considerable
undertaking, Alexander and I would recommend simply limiting the range
of input from users.

As Alexander wrote in a recent email to you, the general opinion of
this list is that terminal emulators should not support the most
dangerous uses of escape sequences, even if they're technically valid.
The attached patch falls into that category. You seem to have made the
argument that the patch "might break valid uses". I've now provided to
you a bit of the backstory and recent basis which motivates this
patch. If this is compelling, I'd rest well knowing it's accepted
upstream. If this is not compelling, could you indicate to the list
why "might break valid uses" outweighs the potential security
mitigations?

Regards,
Jason

diff -ru rxvt-unicode-9.22/src/command.C rxvt-unicode-9.22-patched/src/command.C
--- rxvt-unicode-9.22/src/command.C	2016-01-18 20:35:08.000000000 +0100
+++ rxvt-unicode-9.22-patched/src/command.C	2017-04-28 09:52:35.440245607 +0200
@@ -2868,7 +2868,7 @@
   i = ch - CSI_ICH;
   ndef = get_byte_array_bit (csi_defaults, i);
   for (p = 0; p < nargs; p++)
-    if (arg[p] == -1)
+    if (arg[p] < 0 || arg[p] > 30000)
       arg[p] = ndef;
 
   /*

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ