usa	2017-09-14 20:41:59 +0900 (Thu, 14 Sep 2017)

  New Revision: 59903

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=59903

  Log:
    asn1: fix out-of-bounds read in decoding constructed objects
    
    * OpenSSL::ASN1.{decode,decode_all,traverse}: have a bug of
      out-of-bounds read. int_ossl_asn1_decode0_cons() does not give the
      correct available length to ossl_asn1_decode() when decoding the
      inner components of a constructed object. This can cause
      out-of-bounds read if a crafted input given.
    
    Reference: https://hackerone.com/reports/170316
    https://github.com/ruby/openssl/commit/1648afef33c1d97fb203c82291b8a61269e85d3b

  Modified files:
    branches/ruby_2_2/ChangeLog
    branches/ruby_2_2/ext/openssl/ossl_asn1.c
    branches/ruby_2_2/test/openssl/test_asn1.rb
    branches/ruby_2_2/version.h
Index: ruby_2_2/version.h
===================================================================
--- ruby_2_2/version.h	(revision 59902)
+++ ruby_2_2/version.h	(revision 59903)
@@ -1,6 +1,6 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_2/version.h#L1
 #define RUBY_VERSION "2.2.8"
 #define RUBY_RELEASE_DATE "2017-09-14"
-#define RUBY_PATCHLEVEL 475
+#define RUBY_PATCHLEVEL 476
 
 #define RUBY_RELEASE_YEAR 2017
 #define RUBY_RELEASE_MONTH 9
Index: ruby_2_2/ext/openssl/ossl_asn1.c
===================================================================
--- ruby_2_2/ext/openssl/ossl_asn1.c	(revision 59902)
+++ ruby_2_2/ext/openssl/ossl_asn1.c	(revision 59903)
@@ -871,19 +871,18 @@ int_ossl_asn1_decode0_cons(unsigned char https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ext/openssl/ossl_asn1.c#L871
 {
     VALUE value, asn1data, ary;
     int infinite;
-    long off = *offset;
+    long available_len, off = *offset;
 
     infinite = (j == 0x21);
     ary = rb_ary_new();
 
-    while (length > 0 || infinite) {
+    available_len = infinite ? max_len : length;
+    while (available_len > 0) {
 	long inner_read = 0;
-	value = ossl_asn1_decode0(pp, max_len, &off, depth + 1, yield, &inner_read);
+	value = ossl_asn1_decode0(pp, available_len, &off, depth + 1, yield, &inner_read);
 	*num_read += inner_read;
-	max_len -= inner_read;
+	available_len -= inner_read;
 	rb_ary_push(ary, value);
-	if (length > 0)
-	    length -= inner_read;
 
 	if (infinite &&
 	    NUM2INT(ossl_asn1_get_tag(value)) == V_ASN1_EOC &&
@@ -974,7 +973,7 @@ ossl_asn1_decode0(unsigned char **pp, lo https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ext/openssl/ossl_asn1.c#L973
     if(j & V_ASN1_CONSTRUCTED) {
 	*pp += hlen;
 	off += hlen;
-	asn1data = int_ossl_asn1_decode0_cons(pp, length, len, &off, depth, yield, j, tag, tag_class, &inner_read);
+	asn1data = int_ossl_asn1_decode0_cons(pp, length - hlen, len, &off, depth, yield, j, tag, tag_class, &inner_read);
 	inner_read += hlen;
     }
     else {
Index: ruby_2_2/ChangeLog
===================================================================
--- ruby_2_2/ChangeLog	(revision 59902)
+++ ruby_2_2/ChangeLog	(revision 59903)
@@ -1,3 +1,16 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ChangeLog#L1
+Thu Sep 14 20:39:39 2017  Kazuki Yamaguchi <k@r...>
+
+	asn1: fix out-of-bounds read in decoding constructed objects
+
+	* OpenSSL::ASN1.{decode,decode_all,traverse}: have a bug of
+	  out-of-bounds read. int_ossl_asn1_decode0_cons() does not give the
+	  correct available length to ossl_asn1_decode() when decoding the
+	  inner components of a constructed object. This can cause
+	  out-of-bounds read if a crafted input given.
+
+	Reference: https://hackerone.com/reports/170316
+	https://github.com/ruby/openssl/commit/1648afef33c1d97fb203c82291b8a61269e85d3b
+
 Thu Sep 14 20:36:54 2017  Yusuke Endoh  <mame@r...>
 
 	lib/webrick/log.rb: sanitize any type of logs
Index: ruby_2_2/test/openssl/test_asn1.rb
===================================================================
--- ruby_2_2/test/openssl/test_asn1.rb	(revision 59902)
+++ ruby_2_2/test/openssl/test_asn1.rb	(revision 59903)
@@ -595,6 +595,29 @@ rEzBQ0F9dUyqQ9gyRg8KHhDfv9HzT1d/rnUZMkoo https://github.com/ruby/ruby/blob/trunk/ruby_2_2/test/openssl/test_asn1.rb#L595
     assert_equal(false, asn1.value[3].infinite_length)
   end
 
+  def test_decode_constructed_overread
+    test = %w{ 31 06 31 02 30 02 05 00 }
+    #                          ^ <- invalid
+    raw = [test.join].pack("H*")
+    ret = []
+    assert_raise(OpenSSL::ASN1::ASN1Error) {
+      OpenSSL::ASN1.traverse(raw) { |x| ret << x }
+    }
+    assert_equal 2, ret.size
+    assert_equal 17, ret[0][6]
+    assert_equal 17, ret[1][6]
+
+    test = %w{ 31 80 30 03 00 00 }
+    #                    ^ <- invalid
+    raw = [test.join].pack("H*")
+    ret = []
+    assert_raise(OpenSSL::ASN1::ASN1Error) {
+      OpenSSL::ASN1.traverse(raw) { |x| ret << x }
+    }
+    assert_equal 1, ret.size
+    assert_equal 17, ret[0][6]
+  end
+
   private
 
   def assert_universal(tag, asn1)

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/