Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: check offset arithmetic overflow #15

Merged
merged 1 commit into from
Apr 1, 2019
Merged

feat: check offset arithmetic overflow #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 41 additions & 13 deletions cfb/templates/_legacy_verifier_mod.rs.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,26 +8,46 @@ impl<'a> Verify for reader::{{ name }}<'a> {
let buf = tab.buf;
let buf_len = buf.len();

if tab.loc + flatbuffers::SIZE_SOFFSET > buf_len {
if tab.loc > MAX_OFFSET_LOC || tab.loc + flatbuffers::SIZE_SOFFSET > buf_len {
return Err(Error::OutOfBounds);
}

let vtab_loc = {
let soffset_slice = &buf[tab.loc..tab.loc + flatbuffers::SIZE_SOFFSET];
let soffset_slice = &buf[tab.loc..];
let soffset = flatbuffers::read_scalar::<flatbuffers::SOffsetT>(soffset_slice);
(tab.loc as flatbuffers::SOffsetT - soffset) as usize
};
if vtab_loc + flatbuffers::SIZE_VOFFSET + flatbuffers::SIZE_VOFFSET > buf_len {
if soffset >= 0 {
tab.loc.checked_sub(soffset as usize)
} else {
soffset
.checked_neg()
.and_then(|foffset| tab.loc.checked_add(foffset as usize))
}
}
.ok_or(Error::OutOfBounds)?;
if vtab_loc
.checked_add(flatbuffers::SIZE_VOFFSET + flatbuffers::SIZE_VOFFSET)
.filter(|loc| *loc <= buf_len)
.is_none()
{
return Err(Error::OutOfBounds);
}

let vtab = tab.vtable();
let vtab_num_bytes = vtab.num_bytes();
if vtab_loc + vtab_num_bytes > buf_len {
if vtab_loc
.checked_add(vtab_num_bytes)
.filter(|loc| *loc <= buf_len)
.is_none()
{
return Err(Error::OutOfBounds);
}
let object_inline_num_bytes = vtab.object_inline_num_bytes();
if tab.loc + object_inline_num_bytes > buf_len {
if tab
.loc
.checked_add(object_inline_num_bytes)
.filter(|loc| *loc <= buf_len)
.is_none()
{
return Err(Error::OutOfBounds);
}

Expand All @@ -41,7 +61,9 @@ impl<'a> Verify for reader::{{ name }}<'a> {
}
{%- for field in cfb.fields_sorted_by_offset(object) %}

if Self::VT_{{ cfb.field_name(field) | upper }} as usize + flatbuffers::SIZE_VOFFSET <= vtab_num_bytes {
if Self::VT_{{ cfb.field_name(field) | upper }} as usize + flatbuffers::SIZE_VOFFSET
<= vtab_num_bytes
{
let voffset = vtab.get(Self::VT_{{ cfb.field_name(field) | upper }}) as usize;
{%- if cfb.is_table(field) or cfb.is_string(field) or cfb.is_vector(field) or cfb.is_union(field) %}
if voffset > 0 {
Expand All @@ -58,12 +80,15 @@ impl<'a> Verify for reader::{{ name }}<'a> {
StringVerifier::follow(buf, try_follow_uoffset(buf, tab.loc + voffset)?).verify()?;
{%- elif cfb.is_vector(field) %}

let {{ cfb.field_name(field) }}_verifier =
VectorVerifier::follow(buf, try_follow_uoffset(buf, tab.loc + voffset)?);
let {{ cfb.field_name(field) }}_verifier = VectorVerifier::follow(
buf,
try_follow_uoffset(buf, tab.loc + voffset)?,
);
{%- if cfb.is_element_string(field) %}
{{ cfb.field_name(field) }}_verifier.verify_reference_elements::<StringVerifier>()?;
{%- elif cfb.is_element_table(field) %}
{{ cfb.field_name(field) }}_verifier.verify_reference_elements::<reader::{{ cfb.base_name(cfb.schema.Objects(field.Type().Index())) }}>()?;
{{ cfb.field_name(field) }}_verifier
.verify_reference_elements::<reader::{{ cfb.base_name(cfb.schema.Objects(field.Type().Index())) }}>()?;
{%- else %}
{{ cfb.field_name(field) }}_verifier.verify_scalar_elements({{ cfb.element_size(field) }})?;
{%- endif %}
Expand All @@ -84,7 +109,7 @@ impl<'a> Verify for reader::{{ name }}<'a> {
{%- endif %}
}
{%- else %}
if voffset > 0 && voffset + {{ cfb.field_size(field) }} > object_inline_num_bytes {
if voffset > 0 && object_inline_num_bytes - voffset < {{ cfb.field_size(field) }} {
return Err(Error::OutOfBounds);
}
{%- endif %}
Expand All @@ -106,7 +131,10 @@ pub mod {{ cfb.camel_to_snake(name) }} {
#![allow(unused_imports)]

use super::reader::{{ cfb.camel_to_snake(name) }} as reader;
pub use super::{try_follow_uoffset, Error, Result, StringVerifier, VectorVerifier, Verify};
pub use super::{
try_follow_uoffset, Error, Result, StringVerifier, VectorVerifier, Verify,
MAX_OFFSET_LOC,
};
use flatbuffers::{self, Follow};
{{- mod_content | indent }}
}
Expand Down
38 changes: 27 additions & 11 deletions cfb/templates/legacy_verifier.rs.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,20 +30,23 @@ pub trait Verify {
fn verify(&self) -> Result;
}

pub const MAX_OFFSET_LOC: usize = usize::max_value() - flatbuffers::SIZE_UOFFSET;

fn read_uoffset(buf: &[u8], offset_loc: usize) -> usize {
flatbuffers::read_scalar::<flatbuffers::UOffsetT>(&buf[offset_loc..]) as usize
}

fn try_read_uoffset(buf: &[u8], offset_loc: usize) -> result::Result<usize, Error> {
if offset_loc + flatbuffers::SIZE_UOFFSET <= buf.len() {
if offset_loc <= MAX_OFFSET_LOC && offset_loc + flatbuffers::SIZE_UOFFSET <= buf.len() {
Ok(read_uoffset(buf, offset_loc))
} else {
Err(Error::OutOfBounds)
}
}

pub fn try_follow_uoffset(buf: &[u8], offset_loc: usize) -> result::Result<usize, Error> {
try_read_uoffset(buf, offset_loc).map(|offset| offset_loc + offset)
try_read_uoffset(buf, offset_loc)
.and_then(|offset| offset_loc.checked_add(offset).ok_or(Error::OutOfBounds))
}

#[allow(dead_code)]
Expand All @@ -64,11 +67,14 @@ impl<'a> Verify for StringVerifier<'a> {
let buf_len = self.buf.len();

let len = try_read_uoffset(self.buf, self.loc)?;
if self.loc + flatbuffers::SIZE_UOFFSET + len + 1 > buf_len {
let null_loc = (self.loc + flatbuffers::SIZE_UOFFSET)
.checked_add(len)
.ok_or(Error::OutOfBounds)?;

if null_loc >= buf_len {
return Err(Error::OutOfBounds);
}

if self.buf[self.loc + flatbuffers::SIZE_UOFFSET + len] != 0 {
if self.buf[null_loc] != 0 {
return Err(Error::NonNullTerminatedString);
}

Expand All @@ -93,11 +99,13 @@ impl<'a> VectorVerifier<'a> {
pub fn verify_scalar_elements(&self, scalar_size: usize) -> Result {
let len = try_read_uoffset(self.buf, self.loc)?;

if self.loc + flatbuffers::SIZE_UOFFSET + len * scalar_size > self.buf.len() {
return Err(Error::OutOfBounds);
match (self.loc + flatbuffers::SIZE_UOFFSET)
.checked_add(len * scalar_size)
.filter(|loc| *loc <= self.buf.len())
{
Some(_) => Ok(()),
_ => Err(Error::OutOfBounds),
}

Ok(())
}

pub fn verify_reference_elements<E>(&self) -> Result
Expand All @@ -108,13 +116,21 @@ impl<'a> VectorVerifier<'a> {
let len = try_read_uoffset(self.buf, self.loc)?;

let mut offset_loc = self.loc + flatbuffers::SIZE_UOFFSET;
let end_loc = offset_loc + len * flatbuffers::SIZE_UOFFSET;
let end_loc = offset_loc
.checked_add(len * flatbuffers::SIZE_UOFFSET)
.ok_or(Error::OutOfBounds)?;
if end_loc > self.buf.len() {
return Err(Error::OutOfBounds);
}

while offset_loc < end_loc {
E::follow(self.buf, offset_loc + read_uoffset(self.buf, offset_loc)).verify()?;
E::follow(
self.buf,
offset_loc
.checked_add(read_uoffset(self.buf, offset_loc))
.ok_or(Error::OutOfBounds)?,
)
.verify()?;
offset_loc += flatbuffers::SIZE_UOFFSET;
}

Expand Down
Loading