ruby-changes:41086
From: usa <ko1@a...>
Date: Wed, 16 Dec 2015 21:30:45 +0900 (JST)
Subject: [ruby-changes:41086] usa:r53161 (ruby_2_0_0): merge revision(s): 53153 and 23405@ruby_1_9_1
usa 2015-12-16 21:30:28 +0900 (Wed, 16 Dec 2015) New Revision: 53161 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=53161 Log: merge revision(s): 53153 and 23405@ruby_1_9_1 * ext/fiddle/handle.c: check tainted string arguments. Patch provided by tenderlove and nobu. * test/fiddle/test_handle.rb (class TestHandle): add test for above. * ext/dl/handle.c (rb_dlhandle_initialize): prohibits DL::dlopen with a tainted name of library. Patch by sheepman <sheepman AT sheepman.sakura.ne.jp>. * ext/dl/handle.c (rb_dlhandle_sym): ditto Modified directories: branches/ruby_2_0_0/ Modified files: branches/ruby_2_0_0/ChangeLog branches/ruby_2_0_0/ext/dl/handle.c branches/ruby_2_0_0/ext/fiddle/handle.c branches/ruby_2_0_0/test/fiddle/test_handle.rb branches/ruby_2_0_0/version.h Index: ruby_2_0_0/ChangeLog =================================================================== --- ruby_2_0_0/ChangeLog (revision 53160) +++ ruby_2_0_0/ChangeLog (revision 53161) @@ -1,3 +1,18 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/ChangeLog#L1 +Wed Dec 16 21:16:55 2015 CHIKANAGA Tomoyuki <nagachika@r...> + + * ext/fiddle/handle.c: check tainted string arguments. + Patch provided by tenderlove and nobu. + + * test/fiddle/test_handle.rb (class TestHandle): add test for above. + +Wed Dec 16 21:16:55 2015 Yuki Sonoda (Yugui) <yugui@y...> + + * ext/dl/handle.c (rb_dlhandle_initialize): prohibits DL::dlopen + with a tainted name of library. + Patch by sheepman <sheepman AT sheepman.sakura.ne.jp>. + + * ext/dl/handle.c (rb_dlhandle_sym): ditto + Tue Aug 18 22:00:12 2015 SHIBATA Hiroshi <hsbt@r...> * lib/rubygems.rb: bump version to 2.0.14.1. this version fixed Index: ruby_2_0_0/ext/dl/handle.c =================================================================== --- ruby_2_0_0/ext/dl/handle.c (revision 53160) +++ ruby_2_0_0/ext/dl/handle.c (revision 53161) @@ -5,6 +5,8 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/ext/dl/handle.c#L5 #include <ruby.h> #include "dl.h" +#define SafeStringValuePtr(v) (rb_string_value(&v), rb_check_safe_obj(v), RSTRING_PTR(v)) + VALUE rb_cDLHandle; #ifdef _WIN32 @@ -132,11 +134,11 @@ rb_dlhandle_initialize(int argc, VALUE a https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/ext/dl/handle.c#L134 cflag = RTLD_LAZY | RTLD_GLOBAL; break; case 1: - clib = NIL_P(lib) ? NULL : StringValuePtr(lib); + clib = NIL_P(lib) ? NULL : SafeStringValuePtr(lib); cflag = RTLD_LAZY | RTLD_GLOBAL; break; case 2: - clib = NIL_P(lib) ? NULL : StringValuePtr(lib); + clib = NIL_P(lib) ? NULL : SafeStringValuePtr(lib); cflag = NUM2INT(flag); break; default: @@ -265,13 +267,16 @@ VALUE https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/ext/dl/handle.c#L267 rb_dlhandle_sym(VALUE self, VALUE sym) { struct dl_handle *dlhandle; + const char *name; + + name = SafeStringValuePtr(sym); TypedData_Get_Struct(self, struct dl_handle, &dlhandle_data_type, dlhandle); if( ! dlhandle->open ){ rb_raise(rb_eDLError, "closed handle"); } - return dlhandle_sym(dlhandle->ptr, StringValueCStr(sym)); + return dlhandle_sym(dlhandle->ptr, name); } #ifndef RTLD_NEXT Index: ruby_2_0_0/ext/fiddle/handle.c =================================================================== --- ruby_2_0_0/ext/fiddle/handle.c (revision 53160) +++ ruby_2_0_0/ext/fiddle/handle.c (revision 53161) @@ -1,6 +1,8 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/ext/fiddle/handle.c#L1 #include <ruby.h> #include <fiddle.h> +#define SafeStringValueCStr(v) (rb_check_safe_obj(rb_string_value(&v)), StringValueCStr(v)) + VALUE rb_cHandle; struct dl_handle { @@ -135,11 +137,11 @@ rb_fiddle_handle_initialize(int argc, VA https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/ext/fiddle/handle.c#L137 cflag = RTLD_LAZY | RTLD_GLOBAL; break; case 1: - clib = NIL_P(lib) ? NULL : StringValuePtr(lib); + clib = NIL_P(lib) ? NULL : SafeStringValueCStr(lib); cflag = RTLD_LAZY | RTLD_GLOBAL; break; case 2: - clib = NIL_P(lib) ? NULL : StringValuePtr(lib); + clib = NIL_P(lib) ? NULL : SafeStringValueCStr(lib); cflag = NUM2INT(flag); break; default: @@ -255,7 +257,7 @@ rb_fiddle_handle_to_i(VALUE self) https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/ext/fiddle/handle.c#L257 return PTR2NUM(fiddle_handle); } -static VALUE fiddle_handle_sym(void *handle, const char *symbol); +static VALUE fiddle_handle_sym(void *handle, VALUE symbol); /* * Document-method: sym @@ -274,7 +276,7 @@ rb_fiddle_handle_sym(VALUE self, VALUE s https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/ext/fiddle/handle.c#L276 rb_raise(rb_eFiddleError, "closed handle"); } - return fiddle_handle_sym(fiddle_handle->ptr, StringValueCStr(sym)); + return fiddle_handle_sym(fiddle_handle->ptr, sym); } #ifndef RTLD_NEXT @@ -297,11 +299,11 @@ rb_fiddle_handle_sym(VALUE self, VALUE s https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/ext/fiddle/handle.c#L299 static VALUE rb_fiddle_handle_s_sym(VALUE self, VALUE sym) { - return fiddle_handle_sym(RTLD_NEXT, StringValueCStr(sym)); + return fiddle_handle_sym(RTLD_NEXT, sym); } static VALUE -fiddle_handle_sym(void *handle, const char *name) +fiddle_handle_sym(void *handle, VALUE symbol) { #if defined(HAVE_DLERROR) const char *err; @@ -310,6 +312,7 @@ fiddle_handle_sym(void *handle, const ch https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/ext/fiddle/handle.c#L312 # define CHECK_DLERROR #endif void (*func)(); + const char *name = SafeStringValueCStr(symbol); rb_secure(2); #ifdef HAVE_DLERROR @@ -359,7 +362,7 @@ fiddle_handle_sym(void *handle, const ch https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/ext/fiddle/handle.c#L362 } #endif if( !func ){ - rb_raise(rb_eFiddleError, "unknown symbol \"%s\"", name); + rb_raise(rb_eFiddleError, "unknown symbol \"%"PRIsVALUE"\"", symbol); } return PTR2NUM(func); Index: ruby_2_0_0/version.h =================================================================== --- ruby_2_0_0/version.h (revision 53160) +++ ruby_2_0_0/version.h (revision 53161) @@ -1,10 +1,10 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/version.h#L1 #define RUBY_VERSION "2.0.0" -#define RUBY_RELEASE_DATE "2015-08-18" -#define RUBY_PATCHLEVEL 647 +#define RUBY_RELEASE_DATE "2015-12-16" +#define RUBY_PATCHLEVEL 648 #define RUBY_RELEASE_YEAR 2015 -#define RUBY_RELEASE_MONTH 8 -#define RUBY_RELEASE_DAY 18 +#define RUBY_RELEASE_MONTH 12 +#define RUBY_RELEASE_DAY 16 #include "ruby/version.h" Index: ruby_2_0_0/test/fiddle/test_handle.rb =================================================================== --- ruby_2_0_0/test/fiddle/test_handle.rb (revision 53160) +++ ruby_2_0_0/test/fiddle/test_handle.rb (revision 53161) @@ -10,6 +10,23 @@ module Fiddle https://github.com/ruby/ruby/blob/trunk/ruby_2_0_0/test/fiddle/test_handle.rb#L10 include Test::Unit::Assertions + def test_safe_handle_open + t = Thread.new do + $SAFE = 1 + Fiddle::Handle.new(LIBC_SO.taint) + end + assert_raise(SecurityError) { t.value } + end + + def test_safe_function_lookup + t = Thread.new do + h = Fiddle::Handle.new(LIBC_SO) + $SAFE = 1 + h["qsort".taint] + end + assert_raise(SecurityError) { t.value } + end + def test_to_i handle = Fiddle::Handle.new(LIBC_SO) assert_kind_of Integer, handle.to_i Property changes on: ruby_2_0_0 ___________________________________________________________________ Modified: svn:mergeinfo Merged /trunk:r53153 -- ML: ruby-changes@q... Info: http://www.atdot.net/~ko1/quickml/