Date: Wed, 17 May 2017 13:41:32 +0200 From: "Jason A. Donenfeld" <Jason@...c4.com> To: Marc Lehmann <schmorp@...morp.de>, oss-security <oss-security@...ts.openwall.com> Cc: rxvt-unicode@...morp.de, "jer@...too.org" <jer@...too.org> Subject: Defense in depth patch for rxvt-unicode Hello list, This email thread concerns my request to Marc to include the attached patch inside rxvt-unicode upstream. My own downstream -- Gentoo's jer@, also CCd -- won't include the patch until the agreement of upstream. Thus, it's important we come to a good conclusion. On Wed, May 17, 2017 at 3:17 AM, Marc Lehmann <schmorp@...morp.de> wrote: > On Fri, May 12, 2017 at 02:18:29PM +0200, "Jason A. Donenfeld" <zx2c4@...too.org> wrote: >> I realize I might have used the wrong email address, so please see the >> thread below. > > You used the right address, but since I was quite busy, and your mail > contained nothing but a patch that might break valid uses without any > explanation of what it might be useful for, I didn't immediately know what > to reply and it fell through the cracks. Hi Marc, This patch was part of a larger discussion on which you were CCd from distros. It seems possible that either those messages didn't make it to you, or you didn't have time to read them. In any case, the attached patch would be a useful defense in depth measure to prevent future integer overflow bugs, such as the one that was recently found in rxvt. Briefly looking though the code, it seems like there is a considerable amount of unchecked integer arithmetic, often passing between several functions in several files. Short of somehow auditing every arithmetic call path, a considerable undertaking, Alexander and I would recommend simply limiting the range of input from users. As Alexander wrote in a recent email to you, the general opinion of this list is that terminal emulators should not support the most dangerous uses of escape sequences, even if they're technically valid. The attached patch falls into that category. You seem to have made the argument that the patch "might break valid uses". I've now provided to you a bit of the backstory and recent basis which motivates this patch. If this is compelling, I'd rest well knowing it's accepted upstream. If this is not compelling, could you indicate to the list why "might break valid uses" outweighs the potential security mitigations? Regards, Jason diff -ru rxvt-unicode-9.22/src/command.C rxvt-unicode-9.22-patched/src/command.C --- rxvt-unicode-9.22/src/command.C 2016-01-18 20:35:08.000000000 +0100 +++ rxvt-unicode-9.22-patched/src/command.C 2017-04-28 09:52:35.440245607 +0200 @@ -2868,7 +2868,7 @@ i = ch - CSI_ICH; ndef = get_byte_array_bit (csi_defaults, i); for (p = 0; p < nargs; p++) - if (arg[p] == -1) + if (arg[p] < 0 || arg[p] > 30000) arg[p] = ndef; /*
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ