lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-08-10 05:03:06 +03:00
Code Activity

__gconv_translit_find: Disable function [BZ #17187]

Browse Source 
This functionality has never worked correctly, and the implementation
contained a security vulnerability (CVE-2014-5119).
This commit is contained in:
Florian Weimer
2014-08-26 19:38:59 +02:00
parent e4e7cfd287
commit a1a6a401ab
3 changed files with 19 additions and 174 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@@ -1,3 +1,10 @@
2014-08-26 Florian Weimer <fweimer@redhat.com>
[BZ #17187]
* iconv/gconv_trans.c (struct known_trans, search_tree, lock,
trans_compare, open_translit, __gconv_translit_find):
Remove module loading code.
2014-08-26 Allan McRae <allan@archlinux.org> 2014-08-26 Allan McRae <allan@archlinux.org>
* po/vi.po: Update Vietnamese translation from translation project. * po/vi.po: Update Vietnamese translation from translation project.

9
NEWS
View File

@@ -23,7 +23,7 @@ Version 2.20
16966, 16967, 16977, 16978, 16984, 16990, 16996, 17009, 17022, 17031, 16966, 16967, 16977, 16978, 16984, 16990, 16996, 17009, 17022, 17031,
17042, 17048, 17050, 17058, 17061, 17062, 17069, 17075, 17078, 17079, 17042, 17048, 17050, 17058, 17061, 17062, 17069, 17075, 17078, 17079,
17084, 17086, 17088, 17092, 17097, 17125, 17135, 17137, 17150, 17153, 17084, 17086, 17088, 17092, 17097, 17125, 17135, 17137, 17150, 17153,
17213, 17259, 17261, 17262, 17263. 17187, 17213, 17259, 17261, 17262, 17263.
* Reverted change of ABI data structures for s390 and s390x: * Reverted change of ABI data structures for s390 and s390x:
On s390 and s390x the size of struct ucontext and jmp_buf was increased in On s390 and s390x the size of struct ucontext and jmp_buf was increased in
@@ -108,6 +108,13 @@ Version 2.20
handle the new instruction encodings. This is known to affect Valgrind handle the new instruction encodings. This is known to affect Valgrind
versions up through 3.9 (but will be fixed in the forthcoming 3.10 versions up through 3.9 (but will be fixed in the forthcoming 3.10
release), and might affect other tools that do instruction emulation. release), and might affect other tools that do instruction emulation.
* Support for loadable gconv transliteration modules has been removed.
The support for transliteration modules has been non-functional for
over a decade, and the removal is prompted by security defects. The
normal gconv conversion modules are still supported. Transliteration
with //TRANSLIT is still possible, and the //IGNORE specifier
continues to be supported. (CVE-2014-5519)
Version 2.19 Version 2.19

177
iconv/gconv_trans.c
View File

@@ -238,181 +238,12 @@ __gconv_transliterate (struct __gconv_step *step,
return __GCONV_ILLEGAL_INPUT; return __GCONV_ILLEGAL_INPUT;
} }
/* Structure to represent results of found (or not) transliteration
modules. */
struct known_trans
{
/* This structure must remain the first member. */
struct trans_struct info;
char *fname;
void *handle;
int open_count;
};
/* Tree with results of previous calls to __gconv_translit_find. */
static void *search_tree;
/* We modify global data. */
__libc_lock_define_initialized (static, lock);
/* Compare two transliteration entries. */
static int
trans_compare (const void *p1, const void *p2)
{
const struct known_trans *s1 = (const struct known_trans *) p1;
const struct known_trans *s2 = (const struct known_trans *) p2;
return strcmp (s1->info.name, s2->info.name);
}
/* Open (maybe reopen) the module named in the struct. Get the function
and data structure pointers we need. */
static int
open_translit (struct known_trans *trans)
{
__gconv_trans_query_fct queryfct;
trans->handle = __libc_dlopen (trans->fname);
if (trans->handle == NULL)
/* Not available. */
return 1;
/* Find the required symbol. */
queryfct = __libc_dlsym (trans->handle, "gconv_trans_context");
if (queryfct == NULL)
{
/* We cannot live with that. */
close_and_out:
__libc_dlclose (trans->handle);
trans->handle = NULL;
return 1;
}
/* Get the context. */
if (queryfct (trans->info.name, &trans->info.csnames, &trans->info.ncsnames)
!= 0)
goto close_and_out;
/* Of course we also have to have the actual function. */
trans->info.trans_fct = __libc_dlsym (trans->handle, "gconv_trans");
if (trans->info.trans_fct == NULL)
goto close_and_out;
/* Now the optional functions. */
trans->info.trans_init_fct =
__libc_dlsym (trans->handle, "gconv_trans_init");
trans->info.trans_context_fct =
__libc_dlsym (trans->handle, "gconv_trans_context");
trans->info.trans_end_fct =
__libc_dlsym (trans->handle, "gconv_trans_end");
trans->open_count = 1;
return 0;
}
int int
internal_function internal_function
__gconv_translit_find (struct trans_struct *trans) __gconv_translit_find (struct trans_struct *trans)
{ {
struct known_trans **found; /* Transliteration module loading has been removed because it never
const struct path_elem *runp; worked as intended and suffered from a security vulnerability.
int res = 1; Consequently, this function always fails. */
return 1;
/* We have to have a name. */
assert (trans->name != NULL);
/* Acquire the lock. */
__libc_lock_lock (lock);
/* See whether we know this module already. */
found = __tfind (trans, &search_tree, trans_compare);
if (found != NULL)
{
/* Is this module available? */
if ((*found)->handle != NULL)
{
/* Maybe we have to reopen the file. */
if ((*found)->handle != (void *) -1)
/* The object is not unloaded. */
res = 0;
else if (open_translit (*found) == 0)
{
/* Copy the data. */
*trans = (*found)->info;
(*found)->open_count++;
res = 0;
}
}
}
else
{
size_t name_len = strlen (trans->name) + 1;
int need_so = 0;
struct known_trans *newp;
/* We have to continue looking for the module. */
if (__gconv_path_elem == NULL)
__gconv_get_path ();
/* See whether we have to append .so. */
if (name_len <= 4 || memcmp (&trans->name[name_len - 4], ".so", 3) != 0)
need_so = 1;
/* Create a new entry. */
newp = (struct known_trans *) malloc (sizeof (struct known_trans)
+ (__gconv_max_path_elem_len
+ name_len + 3)
+ name_len);
if (newp != NULL)
{
char *cp;
/* Clear the struct. */
memset (newp, '\0', sizeof (struct known_trans));
/* Store a copy of the module name. */
newp->info.name = cp = (char *) (newp + 1);
cp = __mempcpy (cp, trans->name, name_len);
newp->fname = cp;
/* Search in all the directories. */
for (runp = __gconv_path_elem; runp->name != NULL; ++runp)
{
cp = __mempcpy (__stpcpy ((char *) newp->fname, runp->name),
trans->name, name_len);
if (need_so)
memcpy (cp, ".so", sizeof (".so"));
if (open_translit (newp) == 0)
{
/* We found a module. */
res = 0;
break;
}
}
if (res)
newp->fname = NULL;
/* In any case we'll add the entry to our search tree. */
if (__tsearch (newp, &search_tree, trans_compare) == NULL)
{
/* Yickes, this should not happen. Unload the object. */
res = 1;
/* XXX unload here. */
}
}
}
__libc_lock_unlock (lock);
return res;
} }