musl - out-of-bounds reads in strstr

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201208193919.GA5522@spindle.one-eyed-alien.net>
Date: Tue, 8 Dec 2020 19:39:19 +0000
From: Brooks Davis <brooks@...-eyed-alien.net>
To: musl@...ts.openwall.com
Subject: out-of-bounds reads in strstr

The strstr implementation contains the following snippet which results
in out-of-bounds reads in memchr (we detect them on CHERI because we
have byte-granularity bounds of small buffers):

	/* Fast estimate for MIN(l,63) */
	size_t grow = l | 63;
	const unsigned char *z2 = memchr(z, 0, grow);

The use of `|` means this is very much not an approximation of
`MIN(l,63)`.  What is actually intended here?  For CheriBSD (via FreeBSD)
I need a way to avoid out-of-bounds reads entirely (`MIN(l,63)` does seem
to work in simple system-level testing, but given the mismatch it's
unclear that's what was intended).

Thanks,
Brooks

Download attachment "signature.asc" of type "application/pgp-signature" (456 bytes)

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.