Commit 0ace82d7 authored by Philip Withnall's avatar Philip Withnall Committed by Simon McVittie
Browse files

glib: Use g_memdup2() instead of g_memdup() in obvious places



Convert all the call sites which use `g_memdup()`’s length argument
trivially (for example, by passing a `sizeof()` or an existing `gsize`
variable), so that they use `g_memdup2()` instead.

In almost all of these cases the use of `g_memdup()` would not have
caused problems, but it will soon be deprecated, so best port away from
it

In particular, this fixes an overflow within `g_bytes_new()`, identified
as GHSL-2021-045 (aka CVE-2021-27219) by GHSL team member Kevin Backhouse.

Adapted for GLib 2.58 by Simon McVittie.
Signed-off-by: Philip Withnall's avatarPhilip Withnall <pwithnall@endlessos.org>
Fixes: CVE-2021-27219
Fixes: GHSL-2021-045
Helps: #2319
(cherry picked from commit 0736b7c1

)
[Backport to 2.58: Omit changes to ghash.c, will be a separate commit]
[Backport to 2.58: Omit changes to giochannel.c, not needed in this branch]
[Backport to 2.58: Omit changes to uri test, not needed in this branch]
Signed-off-by: Simon McVittie's avatarSimon McVittie <smcv@collabora.com>
parent 24b94469
......@@ -34,6 +34,8 @@
#include <string.h>
#include "gstrfuncsprivate.h"
/**
* GBytes:
*
......@@ -95,7 +97,7 @@ g_bytes_new (gconstpointer data,
{
g_return_val_if_fail (data != NULL || size == 0, NULL);
return g_bytes_new_take (g_memdup (data, size), size);
return g_bytes_new_take (g_memdup2 (data, size), size);
}
/**
......@@ -499,7 +501,7 @@ g_bytes_unref_to_data (GBytes *bytes,
* Copy: Non g_malloc (or compatible) allocator, or static memory,
* so we have to copy, and then unref.
*/
result = g_memdup (bytes->data, bytes->size);
result = g_memdup2 (bytes->data, bytes->size);
*size = bytes->size;
g_bytes_unref (bytes);
}
......
......@@ -37,6 +37,7 @@
#include "gconvert.h"
#include "gfileutils.h"
#include "gstrfuncs.h"
#include "gstrfuncsprivate.h"
#include "gtestutils.h"
#include "glibintl.h"
......@@ -113,7 +114,7 @@ g_dir_open_with_errno (const gchar *path,
return NULL;
#endif
return g_memdup (&dir, sizeof dir);
return g_memdup2 (&dir, sizeof dir);
}
/**
......
......@@ -41,6 +41,7 @@
#include "gmain.h"
#include "gmem.h" /* gslice.h */
#include "gstrfuncs.h"
#include "gstrfuncsprivate.h"
#include "gutils.h"
#include "gtrashstack.h"
#include "gtestutils.h"
......@@ -349,7 +350,7 @@ g_slice_get_config_state (GSliceConfig ckey,
array[i++] = allocator->contention_counters[address];
array[i++] = allocator_get_magazine_threshold (allocator, address);
*n_values = i;
return g_memdup (array, sizeof (array[0]) * *n_values);
return g_memdup2 (array, sizeof (array[0]) * *n_values);
default:
return NULL;
}
......
......@@ -49,6 +49,7 @@
#include "gpattern.h"
#include "grand.h"
#include "gstrfuncs.h"
#include "gstrfuncsprivate.h"
#include "gtimer.h"
#include "gslice.h"
#include "gspawn.h"
......@@ -3461,7 +3462,7 @@ g_test_log_extract (GTestLogBuffer *tbuffer)
if (p <= tbuffer->data->str + mlength)
{
g_string_erase (tbuffer->data, 0, mlength);
tbuffer->msgs = g_slist_prepend (tbuffer->msgs, g_memdup (&msg, sizeof (msg)));
tbuffer->msgs = g_slist_prepend (tbuffer->msgs, g_memdup2 (&msg, sizeof (msg)));
return TRUE;
}
......
......@@ -33,6 +33,7 @@
#include <string.h>
#include "gstrfuncsprivate.h"
/**
* SECTION:gvariant
......@@ -720,7 +721,7 @@ g_variant_new_variant (GVariant *value)
g_variant_ref_sink (value);
return g_variant_new_from_children (G_VARIANT_TYPE_VARIANT,
g_memdup (&value, sizeof value),
g_memdup2 (&value, sizeof value),
1, g_variant_is_trusted (value));
}
......@@ -1224,7 +1225,7 @@ g_variant_new_fixed_array (const GVariantType *element_type,
return NULL;
}
data = g_memdup (elements, n_elements * element_size);
data = g_memdup2 (elements, n_elements * element_size);
value = g_variant_new_from_data (array_type, data,
n_elements * element_size,
FALSE, g_free, data);
......@@ -1901,7 +1902,7 @@ g_variant_dup_bytestring (GVariant *value,
if (length)
*length = size;
return g_memdup (original, size + 1);
return g_memdup2 (original, size + 1);
}
/**
......
......@@ -28,6 +28,7 @@
#include <string.h>
#include "gstrfuncsprivate.h"
/**
* SECTION:gvarianttype
......@@ -1177,7 +1178,7 @@ g_variant_type_new_tuple (const GVariantType * const *items,
g_assert (offset < sizeof buffer);
buffer[offset++] = ')';
return (GVariantType *) g_memdup (buffer, offset);
return (GVariantType *) g_memdup2 (buffer, offset);
}
/**
......
......@@ -30,6 +30,8 @@
#include <string.h>
#include "glib.h"
#include "gstrfuncsprivate.h"
/* Test data to be passed to any function which calls g_array_new(), providing
* the parameters for that call. Most #GArray tests should be repeated for all
* possible values of #ArrayTestData. */
......@@ -1177,7 +1179,7 @@ byte_array_new_take (void)
GByteArray *gbarray;
guint8 *data;
data = g_memdup ("woooweeewow", 11);
data = g_memdup2 ("woooweeewow", 11);
gbarray = g_byte_array_new_take (data, 11);
g_assert (gbarray->data == data);
g_assert_cmpuint (gbarray->len, ==, 11);
......
......@@ -27,6 +27,8 @@
#include <string.h>
#include <locale.h>
#include "gstrfuncsprivate.h"
static GOptionEntry main_entries[] = {
{ "main-switch", 0, 0,
G_OPTION_ARG_NONE, NULL,
......@@ -256,7 +258,7 @@ join_stringv (int argc, char **argv)
static char **
copy_stringv (char **argv, int argc)
{
return g_memdup (argv, sizeof (char *) * (argc + 1));
return g_memdup2 (argv, sizeof (char *) * (argc + 1));
}
static void
......@@ -2318,7 +2320,7 @@ test_group_parse (void)
g_option_context_add_group (context, group);
argv = split_string ("program --test arg1 -f arg2 --group-test arg3 --frob arg4 -z arg5", &argc);
orig_argv = g_memdup (argv, (argc + 1) * sizeof (char *));
orig_argv = g_memdup2 (argv, (argc + 1) * sizeof (char *));
retval = g_option_context_parse (context, &argc, &argv, &error);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment