qpid-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From astitc...@apache.org
Subject [2/2] qpid-proton git commit: PROTON-1979: [c] Forbid AMQP values that could lead to a nested descriptor type - Any described type descriptors that could lead to a nested described type in the descriptor type itself are forbidden as these can lead to i
Date Thu, 06 Dec 2018 22:23:04 GMT
PROTON-1979: [c] Forbid AMQP values that could lead to a nested descriptor type
- Any described type descriptors that could lead to a nested described type in the
  descriptor type itself are forbidden as these can lead to indefinite stack use.
- In any event only symbol and ulong are currently valid types for descriptors,
  all other types are reserved although syntactically valid (according to amqp 1.0).

Problem found by oss-fuzz: https://oss-fuzz.com/testcase?key=5920119225057280


Project: http://git-wip-us.apache.org/repos/asf/qpid-proton/repo
Commit: http://git-wip-us.apache.org/repos/asf/qpid-proton/commit/5ba471d9
Tree: http://git-wip-us.apache.org/repos/asf/qpid-proton/tree/5ba471d9
Diff: http://git-wip-us.apache.org/repos/asf/qpid-proton/diff/5ba471d9

Branch: refs/heads/master
Commit: 5ba471d97f9e04c8e68f2270681038b3c1eac0ed
Parents: 6a5140b
Author: Andrew Stitcher <astitcher@apache.org>
Authored: Thu Dec 6 14:45:47 2018 -0500
Committer: Andrew Stitcher <astitcher@apache.org>
Committed: Thu Dec 6 17:22:19 2018 -0500

----------------------------------------------------------------------
 c/src/core/decoder.c                               |   7 ++++++-
 .../fuzz-message-decode/crash/5920119225057280     | Bin 0 -> 96383 bytes
 2 files changed, 6 insertions(+), 1 deletion(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/qpid-proton/blob/5ba471d9/c/src/core/decoder.c
----------------------------------------------------------------------
diff --git a/c/src/core/decoder.c b/c/src/core/decoder.c
index fd7b69a..a2e99b2 100644
--- a/c/src/core/decoder.c
+++ b/c/src/core/decoder.c
@@ -485,6 +485,11 @@ static int pni_decoder_decode_type(pn_decoder_t *decoder, pn_data_t *data,
uint8
 
 size_t pn_data_siblings(pn_data_t *data);
 
+static inline bool pni_allowed_descriptor_code(uint8_t code)
+{
+  return code != PNE_DESCRIPTOR && code != PNE_ARRAY8 && code != PNE_ARRAY32;
+}
+
 int pni_decoder_single_described(pn_decoder_t *decoder, pn_data_t *data)
 {
   if (!pn_decoder_remaining(decoder)) {
@@ -493,7 +498,7 @@ int pni_decoder_single_described(pn_decoder_t *decoder, pn_data_t *data)
 
   uint8_t code = *decoder->position++;;
 
-  if (code == PNE_DESCRIPTOR) {
+  if (!pni_allowed_descriptor_code(code)) {
     return PN_ARG_ERR;
   }
 

http://git-wip-us.apache.org/repos/asf/qpid-proton/blob/5ba471d9/c/tests/fuzz/fuzz-message-decode/crash/5920119225057280
----------------------------------------------------------------------
diff --git a/c/tests/fuzz/fuzz-message-decode/crash/5920119225057280 b/c/tests/fuzz/fuzz-message-decode/crash/5920119225057280
new file mode 100644
index 0000000..3a4657d
Binary files /dev/null and b/c/tests/fuzz/fuzz-message-decode/crash/5920119225057280 differ


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org


Mime
View raw message