← Back to branch summary

~clint-fewbar/ubuntu/lucid/mysql-dfsg-5.1/sru-576949

« back to all changes in this revision

Viewing changes to debian/patches/53_CVE-2009-4484.dpatch

  • Committer: Bazaar Package Importer
  • Author(s): Marc Deslauriers
  • Date: 2010-02-22 16:29:37 UTC
  • Revision ID: james.westby@ubuntu.com-20100222162937-lvj5tpszlw3iukef
Tags: 5.1.41-3ubuntu7
* SECURITY UPDATE: privilege restriction bypass via incorrect calculation
  of the mysql_unpacked_real_data_home value
  - debian/patches/52_CVE-2009-4030.dpatch: fix initialization order in
    sql/mysqld.cc.
  - CVE-2009-4030
* SECURITY UPDATE: arbitrary code execution via yassl stack overflow
  - debian/patches/53_CVE-2009-4484.dpatch: validate lengths in
    extra/yassl/taocrypt/src/asn.*.
  - CVE-2009-4484
* SECURITY UPDATE: access restriction bypass via symlink
  - debian/patches/54_CVE-2008-7247.dpatch: improve symlink handling in
    sql/sql_table.cc.
  - CVE-2008-7247

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/53_CVE-2009-4484.dpatch
 
1
#! /bin/sh /usr/share/dpatch/dpatch-run
 
2
# Description: fix arbitrary code execution via yassl stack overflow
 
3
# Origin: upstream, http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.1/revision/3311.1.3
 
4
# Bug: http://bugs.mysql.com/bug.php?id=50227
 
5
 
 
6
@DPATCH@
 
7
diff -urNad mysql-dfsg-5.1-5.1.41~/extra/yassl/taocrypt/include/asn.hpp mysql-dfsg-5.1-5.1.41/extra/yassl/taocrypt/include/asn.hpp
 
8
--- mysql-dfsg-5.1-5.1.41~/extra/yassl/taocrypt/include/asn.hpp 2009-11-04 13:28:12.000000000 -0500
 
9
+++ mysql-dfsg-5.1-5.1.41/extra/yassl/taocrypt/include/asn.hpp  2010-02-22 16:28:36.000000000 -0500
 
10
@@ -305,6 +305,7 @@
 
11
     bool   ValidateSignature(SignerList*);
 
12
     bool   ConfirmSignature(Source&);
 
13
     void   GetKey();
 
14
+    char*  AddTag(char*, const char*, const char*, word32, word32);
 
15
     void   GetName(NameType);
 
16
     void   GetValidity();
 
17
     void   GetDate(DateType);
 
18
diff -urNad mysql-dfsg-5.1-5.1.41~/extra/yassl/taocrypt/src/asn.cpp mysql-dfsg-5.1-5.1.41/extra/yassl/taocrypt/src/asn.cpp
 
19
--- mysql-dfsg-5.1-5.1.41~/extra/yassl/taocrypt/src/asn.cpp     2009-11-04 13:28:13.000000000 -0500
 
20
+++ mysql-dfsg-5.1-5.1.41/extra/yassl/taocrypt/src/asn.cpp      2010-02-22 16:28:36.000000000 -0500
 
21
@@ -652,6 +652,23 @@
 
22
 }
 
23
 
 
24
 
 
25
+char *CertDecoder::AddTag(char *ptr, const char *buf_end, 
 
26
+                          const char *tag_name, word32 tag_name_length,
 
27
+                          word32 tag_value_length)
 
28
+{
 
29
+  if (ptr + tag_name_length + tag_value_length > buf_end)
 
30
+      return 0;
 
31
+    
 
32
+  memcpy(ptr, tag_name, tag_name_length);
 
33
+  ptr+= tag_name_length;
 
34
+  
 
35
+  memcpy(ptr, source_.get_current(), tag_value_length);
 
36
+  ptr+= tag_value_length;
 
37
+  
 
38
+  return ptr;
 
39
+}
 
40
+
 
41
+
 
42
 // process NAME, either issuer or subject
 
43
 void CertDecoder::GetName(NameType nt)
 
44
 {
 
45
@@ -659,11 +676,21 @@
 
46
 
 
47
     SHA    sha;
 
48
     word32 length = GetSequence();  // length of all distinguished names
 
49
-    assert (length < ASN_NAME_MAX);
 
50
+
 
51
+    if (length >= ASN_NAME_MAX)
 
52
+        goto err;
 
53
     length += source_.get_index();
 
54
 
 
55
-    char*  ptr = (nt == ISSUER) ? issuer_ : subject_;
 
56
-    word32 idx = 0;
 
57
+    char *ptr, *buf_end;
 
58
+
 
59
+    if (nt == ISSUER) {
 
60
+        ptr= issuer_;
 
61
+        buf_end= ptr + sizeof(issuer_) - 1;  // 1 byte for trailing 0
 
62
+    }
 
63
+    else {
 
64
+        ptr= subject_;
 
65
+        buf_end= ptr + sizeof(subject_) - 1;  // 1 byte for trailing 0
 
66
+    }
 
67
 
 
68
     while (source_.get_index() < length) {
 
69
         GetSet();
 
70
@@ -685,47 +712,36 @@
 
71
             byte   id      = source_.next();  
 
72
             b              = source_.next();    // strType
 
73
             word32 strLen  = GetLength(source_);
 
74
-            bool   copy    = false;
 
75
 
 
76
-            if (id == COMMON_NAME) {
 
77
-                memcpy(&ptr[idx], "/CN=", 4);
 
78
-                idx += 4;
 
79
-                copy = true;
 
80
-            }
 
81
-            else if (id == SUR_NAME) {
 
82
-                memcpy(&ptr[idx], "/SN=", 4);
 
83
-                idx += 4;
 
84
-                copy = true;
 
85
-            }
 
86
-            else if (id == COUNTRY_NAME) {
 
87
-                memcpy(&ptr[idx], "/C=", 3);
 
88
-                idx += 3;
 
89
-                copy = true;
 
90
-            }
 
91
-            else if (id == LOCALITY_NAME) {
 
92
-                memcpy(&ptr[idx], "/L=", 3);
 
93
-                idx += 3;
 
94
-                copy = true;
 
95
-            }
 
96
-            else if (id == STATE_NAME) {
 
97
-                memcpy(&ptr[idx], "/ST=", 4);
 
98
-                idx += 4;
 
99
-                copy = true;
 
100
-            }
 
101
-            else if (id == ORG_NAME) {
 
102
-                memcpy(&ptr[idx], "/O=", 3);
 
103
-                idx += 3;
 
104
-                copy = true;
 
105
-            }
 
106
-            else if (id == ORGUNIT_NAME) {
 
107
-                memcpy(&ptr[idx], "/OU=", 4);
 
108
-                idx += 4;
 
109
-                copy = true;
 
110
-            }
 
111
-
 
112
-            if (copy) {
 
113
-                memcpy(&ptr[idx], source_.get_current(), strLen);
 
114
-                idx += strLen;
 
115
+            switch (id) {
 
116
+            case COMMON_NAME:
 
117
+                if (!(ptr= AddTag(ptr, buf_end, "/CN=", 4, strLen)))
 
118
+                  goto err;
 
119
+                break;
 
120
+            case SUR_NAME:
 
121
+                if (!(ptr= AddTag(ptr, buf_end, "/SN=", 4, strLen)))
 
122
+                  goto err;
 
123
+                break;
 
124
+            case COUNTRY_NAME:
 
125
+                if (!(ptr= AddTag(ptr, buf_end, "/C=", 3, strLen)))
 
126
+                  goto err;
 
127
+                break;
 
128
+            case LOCALITY_NAME:
 
129
+                if (!(ptr= AddTag(ptr, buf_end, "/L=", 3, strLen)))
 
130
+                  goto err;
 
131
+                break;
 
132
+            case STATE_NAME:
 
133
+                if (!(ptr= AddTag(ptr, buf_end, "/ST=", 4, strLen)))
 
134
+                  goto err;
 
135
+                break;
 
136
+            case ORG_NAME:
 
137
+                if (!(ptr= AddTag(ptr, buf_end, "/O=", 3, strLen)))
 
138
+                  goto err;
 
139
+                break;
 
140
+            case ORGUNIT_NAME:
 
141
+                if (!(ptr= AddTag(ptr, buf_end, "/OU=", 4, strLen)))
 
142
+                  goto err;
 
143
+                break;
 
144
             }
 
145
 
 
146
             sha.Update(source_.get_current(), strLen);
 
147
@@ -739,23 +755,20 @@
 
148
             source_.advance(oidSz + 1);
 
149
             word32 length = GetLength(source_);
 
150
 
 
151
-            if (email) {
 
152
-                memcpy(&ptr[idx], "/emailAddress=", 14);
 
153
-                idx += 14;
 
154
-
 
155
-                memcpy(&ptr[idx], source_.get_current(), length);
 
156
-                idx += length;
 
157
-            }
 
158
+            if (email && !(ptr= AddTag(ptr, buf_end, "/emailAddress=", 14, length)))
 
159
+                goto err;
 
160
 
 
161
             source_.advance(length);
 
162
         }
 
163
     }
 
164
-    ptr[idx++] = 0;
 
165
+    *ptr= 0;
 
166
 
 
167
-    if (nt == ISSUER)
 
168
-        sha.Final(issuerHash_);
 
169
-    else
 
170
-        sha.Final(subjectHash_);
 
171
+    sha.Final(nt == ISSUER ? issuerHash_ : subjectHash_);
 
172
+        
 
173
+    return;
 
174
+    
 
175
+err:
 
176
+    source_.SetError(CONTENT_E);
 
177
 }
 
178
 
 
179