• R/O
  • HTTP
  • SSH
  • HTTPS

tomoyo-test1: コミット

This is a test repository.


コミットメタ情報

リビジョンe991a40b3d0000a2f48729aea4ce03acf679b5ee (tree)
日時2020-11-03 13:50:02
作者Tetsuo Handa <penguin-kernel@I-lo...>
コミッターTetsuo Handa

ログメッセージ

tomoyo: Limit wildcard recursion depth.

Since wildcards that need recursion consume kernel stack memory (or might
cause CPU stall warning problem), we cannot allow infinite recursion.

Since TOMOYO 1.8 survived with 20 recursions limit for 5 years, nobody
would complain if applying this limit to TOMOYO 2.6.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

変更サマリ

差分

--- a/security/tomoyo/util.c
+++ b/security/tomoyo/util.c
@@ -434,59 +434,64 @@ void tomoyo_normalize_line(unsigned char *buffer)
434434 */
435435 static bool tomoyo_correct_word2(const char *string, size_t len)
436436 {
437+ u8 recursion = 20;
437438 const char *const start = string;
438439 bool in_repetition = false;
439- unsigned char c;
440- unsigned char d;
441- unsigned char e;
442440
443441 if (!len)
444442 goto out;
445443 while (len--) {
446- c = *string++;
444+ unsigned char c = *string++;
445+
447446 if (c == '\\') {
448447 if (!len--)
449448 goto out;
450449 c = *string++;
450+ if (c >= '0' && c <= '3') {
451+ unsigned char d;
452+ unsigned char e;
453+
454+ if (!len-- || !len--)
455+ goto out;
456+ d = *string++;
457+ e = *string++;
458+ if (d < '0' || d > '7' || e < '0' || e > '7')
459+ goto out;
460+ c = tomoyo_make_byte(c, d, e);
461+ if (c <= ' ' || c >= 127)
462+ continue;
463+ goto out;
464+ }
451465 switch (c) {
452466 case '\\': /* "\\" */
453- continue;
454- case '$': /* "\$" */
455467 case '+': /* "\+" */
456468 case '?': /* "\?" */
469+ case 'x': /* "\x" */
470+ case 'a': /* "\a" */
471+ case '-': /* "\-" */
472+ continue;
473+ }
474+ if (!recursion--)
475+ goto out;
476+ switch (c) {
457477 case '*': /* "\*" */
458478 case '@': /* "\@" */
459- case 'x': /* "\x" */
479+ case '$': /* "\$" */
460480 case 'X': /* "\X" */
461- case 'a': /* "\a" */
462481 case 'A': /* "\A" */
463- case '-': /* "\-" */
464482 continue;
465483 case '{': /* "/\{" */
466484 if (string - 3 < start || *(string - 3) != '/')
467- break;
485+ goto out;
468486 in_repetition = true;
469487 continue;
470488 case '}': /* "\}/" */
471489 if (*string != '/')
472- break;
490+ goto out;
473491 if (!in_repetition)
474- break;
492+ goto out;
475493 in_repetition = false;
476494 continue;
477- case '0': /* "\ooo" */
478- case '1':
479- case '2':
480- case '3':
481- if (!len-- || !len--)
482- break;
483- d = *string++;
484- e = *string++;
485- if (d < '0' || d > '7' || e < '0' || e > '7')
486- break;
487- c = tomoyo_make_byte(c, d, e);
488- if (c <= ' ' || c >= 127)
489- continue;
490495 }
491496 goto out;
492497 } else if (in_repetition && c == '/') {
旧リポジトリブラウザで表示