[WLB-2008080064: inet_net_pton() integer overflow ] Author: Maksymilian Arciemowicz Date: - - Written: 02.08.2008 - - Public: 22.08.2008 Risk: Low It is a bug, without a high security risk. We are going informing all vendors, about this problem. Affected Software: libc inet_net_pton.c ver ISC Bind - - OpenBSD fixed Vendor: http://www.isc.org/index.pl?/sw/bind/index.php - --- 0.Description --- inet_net_pton - Internet network number manipulation routines SYNOPSIS: int inet_net_pton(int af, const char *src, void *dst, size_t size); The inet_net_pton() function converts a presentation format Internet network number (that is, printable form as held in a character string) to network format (usually a struct in_addr or some other internal binary representation, in network byte order). It returns the number of bits (either computed based on the class, or specified with /CIDR), or -1 if a failure occurred (in which case errno will have been set. It will be set to ENOENT if the Internet network number was not valid). Caution: The dst field should be zeroed before calling inet_net_pton() as the function will only fill the number of bytes necessary to encode the network number in network byte order. The only value for af currently supported is AF_INET. size is the size of the result buffer dst. NETWORK NUMBERS (IP VERSION 4) The external representation of Internet network numbers may be specified in one of the following forms: a a.b a.b.c a.b.c.d Any of the above four forms may have ``/bits'' appended where ``bits'' is in the range 0-32 and is used to explicitly specify the number of bits in the network address. When ``/bits'' is not specified the number of bits - --- 1. libc/net inet_net_pton() integer overflow --- The main problem exist in inet_net_pton() function. Let's see to this function inet_net_pton.c - --- int inet_net_pton(int af, const char *src, void *dst, size_t size) { switch (af) { case AF_INET: return (inet_net_pton_ipv4(src, dst, size)); default: errno = EAFNOSUPPORT; return (-1); } } - --- call to inet_net_pton_ipv4(). So let's see it.. - -START-- static int inet_net_pton_ipv4(const char *src, u_char *dst, size_t size) { static const char xdigits[] = "0123456789abcdef", digits[] = "0123456789"; int n, ch, tmp, dirty, bits; const u_char *odst = dst; ch = *src++; if (ch == '0' && (src[0] == 'x' || src[0] == 'X') && isascii(src[1]) && isxdigit(src[1])) { /* Hexadecimal: Eat nybble string. */ if (size <= 0) goto emsgsize; *dst = 0, dirty = 0; src++; /* skip x or X. */ while ((ch = *src++) != '\0' && isascii(ch) && isxdigit(ch)) { if (isupper(ch)) ch = tolower(ch); n = strchr(xdigits, ch) - xdigits; assert(n >= 0 && n <= 15); *dst |= n; if (!dirty++) *dst <<= 4; else if (size-- > 0) *++dst = 0, dirty = 0; else goto emsgsize; } if (dirty) size--; } else if (isascii(ch) && isdigit(ch)) { /* Decimal: eat dotted digit string. */ for (;;) { tmp = 0; do { n = strchr(digits, ch) - digits; assert(n >= 0 && n <= 9); tmp *= 10; tmp += n; if (tmp > 255) goto enoent; } while ((ch = *src++) != '\0' && isascii(ch) && isdigit(ch)); if (size-- <= 0) goto emsgsize; *dst++ = (u_char) tmp; if (ch == '\0' || ch == '/') break; if (ch != '.') goto enoent; ch = *src++; if (!isascii(ch) || !isdigit(ch)) goto enoent; } } else goto enoent; bits = -1; if (ch == '/' && isascii(src[0]) && isdigit(src[0]) && dst > odst) { /* CIDR width specifier. Nothing can follow it. */ ch = *src++; /* Skip over the /. */ bits = 0; do { n = strchr(digits, ch) - digits; assert(n >= 0 && n <= 9); bits *= 10; bits += n; } while ((ch = *src++) != '\0' && isascii(ch) && isdigit(ch)); - -SLEEP--- bits integer is signed, - -WAKEUP--- if (ch != '\0') goto enoent; if (bits > 32) goto emsgsize; - -SLEEP--- if bits > 32 , we will go to emsgize, but for *dst = "127.0.0.1/2147483649" <=> bits=-2147483647 we will not goto emsgsize ok, continue - --WAKEUP--- } /* Firey death and destruction unless we prefetched EOS. */ if (ch != '\0') goto enoent; /* If nothing was written to the destination, we found no address. */ if (dst == odst) goto enoent; /* If no CIDR spec was given, infer width from net class. */ if (bits == -1) { if (*odst >= 240) /* Class E */ bits = 32; else if (*odst >= 224) /* Class D */ bits = 4; else if (*odst >= 192) /* Class C */ bits = 24; else if (*odst >= 128) /* Class B */ bits = 16; else /* Class A */ bits = 8; /* If imputed mask is narrower than specified octets, widen. */ if (bits < ((dst - odst) * 8)) bits = (dst - odst) * 8; } /* Extend network to cover the actual mask. */ while (bits > ((dst - odst) * 8)) { if (size-- <= 0) goto emsgsize; *dst++ = '\0'; } return (bits); - -STOP--- ... - -END--- (bits > ((dst - odst) * 8))==FALSE so '\0' will not be set in *dst. bits is returned. For example: af=AF_INET src=127.0.0.1/2147483649 function will return -2147483647 and pointer dst will don't have null byte of end. A lot of programs use inet_net_pton() in if() function, like if(inet_net_pton(...)!=-1){ blabla... } else ERROR... In specification we can find - --- ...It returns the number of bits (either computed based on the class, or specified with /CIDR), or -1 if a failure occurred (in which case errno will have been set... - --- /* Only -1 is reserved for errors. */ and - --- Any of the above four forms may have ``/bits'' appended where ``bits'' is in the range 0-32 and is used to explicitly specify the number of bits in the network address. When ``/bits'' is not specified the number of bits #include <arpa/inet.h> - --- so if (bits > 32) goto emsgsize; dosen't protect us, before integer overflow. Security Risk is here very low, but bug should be corrected. We will only inform all vendors. ISC BIND has been informed and confirmed existing a bug. Comments: - --- ... I don't see this as something one needs to be alarmed about. It is a bug and it does need to be addressed. Vendors that have included our code do need to be informed. ... - --- - --- ... It just looks like a bug that for now that has, luckily, no security consequences, as far as we can see ... - --- - --- ... Additionally dst is a binary blob, not a C string, and as such doesn't require '\0' termination. While returning the wrong value for when the cidr mask length overflows is a bad, almost all inputs to this function will be from configuration files. For this to be a issue there needs to be gross configuration errors in those configuration files. ... - --- - --- 2. Credit --- Maksymilian Arciemowicz