lib/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2026-10-24 00:49:00 +03:00
Code Activity

gfileattribute: Fix integer overflow calculating escaping for byte strings

Browse Source 
The number of invalid characters in the byte string (characters which
would have to be percent-encoded) was only stored in an `int`, which
gave the possibility of a long string largely full of invalid
characters overflowing this and allowing an attacker-controlled buffer
size to be allocated.

This could be triggered by an attacker controlled file attribute (of
type `G_FILE_ATTRIBUTE_TYPE_BYTE_STRING`), such as
`G_FILE_ATTRIBUTE_THUMBNAIL_PATH` or `G_FILE_ATTRIBUTE_STANDARD_NAME`,
being read by user code.

Spotted by Codean Labs.

Signed-off-by: Philip Withnall <pwithnall@gnome.org>

Fixes: #3845
This commit is contained in:
Philip Withnall
2025-12-04 16:37:19 +00:00
committed by Michael Catanzaro
parent 22b1d83564
commit 960a0aee45
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
gio/gfileattribute.c
View File

@@ -20,6 +20,7 @@
#include "config.h"
#include <stdint.h>
#include <string.h>
#include "gfileattribute.h"
@@ -271,11 +272,12 @@ valid_char (char c)
return c >= 32 && c <= 126 && c != '\\';
}
/* Returns NULL on error */
static char *
escape_byte_string (const char *str)
{
size_t i, len;
int num_invalid;
size_t num_invalid;
char *escaped_val, *p;
unsigned char c;
const char hex_digits[] = "0123456789abcdef";
@@ -293,7 +295,12 @@ escape_byte_string (const char *str)
return g_strdup (str);
else
{
escaped_val = g_malloc (len + num_invalid*3 + 1);
/* Check for overflow. We want to check the inequality:
* !(len + num_invalid * 3 + 1 > SIZE_MAX) */
if (num_invalid >= (SIZE_MAX - len) / 3)
return NULL;
escaped_val = g_malloc (len + num_invalid * 3 + 1);
p = escaped_val;
for (i = 0; i < len; i++)