Skip to content

Commit 5e63d8e

Browse files
[AUTO-CHERRYPICK] libtasn1: Address CVE-2024-12133 [High] - branch main (#12665)
Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com>
1 parent ea3e039 commit 5e63d8e

6 files changed

Lines changed: 245 additions & 10 deletions

File tree

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
From 869a97aa259dffa2620dabcad84e1c22545ffc3d Mon Sep 17 00:00:00 2001
2+
From: Daiki Ueno <ueno@gnu.org>
3+
Date: Fri, 8 Nov 2024 16:05:32 +0900
4+
Subject: [PATCH] asn1_find_node: optimize "?NUMBER" node lookup with indexing
5+
6+
To avoid linear search of named nodes, this adds a array of child
7+
nodes to their parent nodes as a cache.
8+
9+
Signed-off-by: Daiki Ueno <ueno@gnu.org>
10+
Signed-off-by: Simon Josefsson <simon@josefsson.org>
11+
---
12+
lib/element.c | 56 ++++++++++++++++++++++++++++++++++++++++++------
13+
lib/element.h | 10 +++++++++
14+
lib/int.h | 8 +++++++
15+
lib/parser_aux.c | 10 +++++++++
16+
lib/structure.c | 13 +++++++++++
17+
5 files changed, 90 insertions(+), 7 deletions(-)
18+
19+
diff --git a/lib/element.c b/lib/element.c
20+
index 850bef4a..528df418 100644
21+
--- a/lib/element.c
22+
+++ b/lib/element.c
23+
@@ -33,6 +33,8 @@
24+
#include "structure.h"
25+
#include "c-ctype.h"
26+
#include "element.h"
27+
+#include <limits.h>
28+
+#include "intprops.h"
29+
30+
void
31+
_asn1_hierarchical_name (asn1_node_const node, char *name, int name_size)
32+
@@ -129,6 +131,41 @@ _asn1_convert_integer (const unsigned char *value, unsigned char *value_out,
33+
return ASN1_SUCCESS;
34+
}
35+
36+
+int
37+
+_asn1_node_array_set (struct asn1_node_array_st *array, size_t position,
38+
+ asn1_node node)
39+
+{
40+
+ if (position >= array->size)
41+
+ {
42+
+ size_t new_size = position, i;
43+
+ asn1_node *new_nodes;
44+
+
45+
+ if (INT_MULTIPLY_OVERFLOW (new_size, 2))
46+
+ return ASN1_GENERIC_ERROR;
47+
+ new_size *= 2;
48+
+
49+
+ if (INT_ADD_OVERFLOW (new_size, 1))
50+
+ return ASN1_GENERIC_ERROR;
51+
+ new_size += 1;
52+
+
53+
+ if (INT_MULTIPLY_OVERFLOW (new_size, sizeof (*new_nodes)))
54+
+ return ASN1_GENERIC_ERROR;
55+
+
56+
+ new_nodes = realloc (array->nodes, new_size * sizeof (*new_nodes));
57+
+ if (!new_nodes)
58+
+ return ASN1_MEM_ALLOC_ERROR;
59+
+
60+
+ for (i = array->size; i < new_size; i++)
61+
+ new_nodes[i] = NULL;
62+
+
63+
+ array->nodes = new_nodes;
64+
+ array->size = new_size;
65+
+ }
66+
+
67+
+ array->nodes[position] = node;
68+
+ return ASN1_SUCCESS;
69+
+}
70+
+
71+
/* Appends a new element into the sequence (or set) defined by this
72+
* node. The new element will have a name of '?number', where number
73+
* is a monotonically increased serial number.
74+
@@ -145,6 +182,7 @@ _asn1_append_sequence_set (asn1_node node, struct node_tail_cache_st *pcache)
75+
asn1_node p, p2;
76+
char temp[LTOSTR_MAX_SIZE + 1];
77+
long n;
78+
+ int result;
79+
80+
if (!node || !(node->down))
81+
return ASN1_GENERIC_ERROR;
82+
@@ -177,17 +215,21 @@ _asn1_append_sequence_set (asn1_node node, struct node_tail_cache_st *pcache)
83+
pcache->tail = p2;
84+
}
85+
86+
- if (p->name[0] == 0)
87+
- _asn1_str_cpy (temp, sizeof (temp), "?1");
88+
- else
89+
+ n = 0;
90+
+ if (p->name[0] != 0)
91+
{
92+
- n = strtol (p->name + 1, NULL, 0);
93+
- n++;
94+
- temp[0] = '?';
95+
- _asn1_ltostr (n, temp + 1);
96+
+ n = strtol (p->name + 1, NULL, 10);
97+
+ if (n <= 0 || n >= LONG_MAX - 1)
98+
+ return ASN1_GENERIC_ERROR;
99+
}
100+
+ temp[0] = '?';
101+
+ _asn1_ltostr (n + 1, temp + 1);
102+
_asn1_set_name (p2, temp);
103+
/* p2->type |= CONST_OPTION; */
104+
+ result = _asn1_node_array_set (&node->numbered_children, n, p2);
105+
+ if (result != ASN1_SUCCESS)
106+
+ return result;
107+
+ p2->parent = node;
108+
109+
return ASN1_SUCCESS;
110+
}
111+
diff --git a/lib/element.h b/lib/element.h
112+
index 732054e9..b84e3a27 100644
113+
--- a/lib/element.h
114+
+++ b/lib/element.h
115+
@@ -38,4 +38,14 @@ int _asn1_convert_integer (const unsigned char *value,
116+
void _asn1_hierarchical_name (asn1_node_const node, char *name,
117+
int name_size);
118+
119+
+static inline asn1_node_const
120+
+_asn1_node_array_get (const struct asn1_node_array_st *array, size_t position)
121+
+{
122+
+ return position < array->size ? array->nodes[position] : NULL;
123+
+}
124+
+
125+
+int
126+
+_asn1_node_array_set (struct asn1_node_array_st *array, size_t position,
127+
+ asn1_node node);
128+
+
129+
#endif
130+
diff --git a/lib/int.h b/lib/int.h
131+
index 4f2d98d1..41b12b0b 100644
132+
--- a/lib/int.h
133+
+++ b/lib/int.h
134+
@@ -31,6 +31,12 @@
135+
136+
# define ASN1_SMALL_VALUE_SIZE 16
137+
138+
+struct asn1_node_array_st
139+
+{
140+
+ asn1_node *nodes;
141+
+ size_t size;
142+
+};
143+
+
144+
/* This structure is also in libtasn1.h, but then contains less
145+
fields. You cannot make any modifications to these first fields
146+
without breaking ABI. */
147+
@@ -47,6 +53,8 @@ struct asn1_node_st
148+
asn1_node left; /* Pointer to the next list element */
149+
/* private fields: */
150+
unsigned char small_value[ASN1_SMALL_VALUE_SIZE]; /* For small values */
151+
+ asn1_node parent; /* Pointer to the parent node */
152+
+ struct asn1_node_array_st numbered_children; /* Array of unnamed child nodes for caching */
153+
154+
/* values used during decoding/coding */
155+
int tmp_ival;
156+
diff --git a/lib/parser_aux.c b/lib/parser_aux.c
157+
index 415905a0..4281cc97 100644
158+
--- a/lib/parser_aux.c
159+
+++ b/lib/parser_aux.c
160+
@@ -126,6 +126,7 @@ asn1_find_node (asn1_node_const pointer, const char *name)
161+
const char *n_start;
162+
unsigned int nsize;
163+
unsigned int nhash;
164+
+ const struct asn1_node_array_st *numbered_children;
165+
166+
if (pointer == NULL)
167+
return NULL;
168+
@@ -209,6 +210,7 @@ asn1_find_node (asn1_node_const pointer, const char *name)
169+
if (p->down == NULL)
170+
return NULL;
171+
172+
+ numbered_children = &p->numbered_children;
173+
p = p->down;
174+
if (p == NULL)
175+
return NULL;
176+
@@ -222,6 +224,12 @@ asn1_find_node (asn1_node_const pointer, const char *name)
177+
}
178+
else
179+
{ /* no "?LAST" */
180+
+ if (n[0] == '?' && c_isdigit (n[1]))
181+
+ {
182+
+ long position = strtol (n + 1, NULL, 10);
183+
+ if (position > 0 && position < LONG_MAX)
184+
+ p = _asn1_node_array_get (numbered_children, position - 1);
185+
+ }
186+
while (p)
187+
{
188+
if (p->name_hash == nhash && !strcmp (p->name, n))
189+
@@ -509,6 +517,8 @@ _asn1_remove_node (asn1_node node, unsigned int flags)
190+
if (node->value != node->small_value)
191+
free (node->value);
192+
}
193+
+
194+
+ free (node->numbered_children.nodes);
195+
free (node);
196+
}
197+
198+
diff --git a/lib/structure.c b/lib/structure.c
199+
index 9c95b9e2..32692ad2 100644
200+
--- a/lib/structure.c
201+
+++ b/lib/structure.c
202+
@@ -31,6 +31,9 @@
203+
#include <structure.h>
204+
#include "parser_aux.h"
205+
#include <gstr.h>
206+
+#include "c-ctype.h"
207+
+#include "element.h"
208+
+#include <limits.h>
209+
210+
211+
extern char _asn1_identifierMissing[];
212+
@@ -391,6 +394,16 @@ asn1_delete_element (asn1_node structure, const char *element_name)
213+
if (source_node == NULL)
214+
return ASN1_ELEMENT_NOT_FOUND;
215+
216+
+ if (source_node->parent
217+
+ && source_node->name[0] == '?'
218+
+ && c_isdigit (source_node->name[1]))
219+
+ {
220+
+ long position = strtol (source_node->name + 1, NULL, 10);
221+
+ if (position > 0 && position < LONG_MAX)
222+
+ _asn1_node_array_set (&source_node->parent->numbered_children,
223+
+ position - 1, NULL);
224+
+ }
225+
+
226+
p2 = source_node->right;
227+
p3 = _asn1_find_left (source_node);
228+
if (!p3)
229+
--
230+
GitLab
231+

SPECS/libtasn1/libtasn1.spec

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
Summary: ASN.1 library
22
Name: libtasn1
33
Version: 4.19.0
4-
Release: 1%{?dist}
4+
Release: 2%{?dist}
55
License: GPLv3+ AND LGPLv2+
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
88
Group: System Environment/Libraries
99
URL: https://www.gnu.org/software/libtasn1/
1010
Source0: https://ftp.gnu.org/gnu/libtasn1/%{name}-%{version}.tar.gz
11+
Patch0: CVE-2024-12133.patch
1112
Provides: libtasn1-tools = %{version}-%{release}
1213

1314
%description
@@ -23,7 +24,7 @@ The package contains libraries and header files for
2324
developing applications that use libtasn1.
2425

2526
%prep
26-
%setup -q
27+
%autosetup -p1
2728

2829
%build
2930
./configure \
@@ -57,6 +58,9 @@ make %{?_smp_mflags} check
5758
%{_mandir}/man3/*
5859

5960
%changelog
61+
* Fri Feb 21 2025 Ankita Pareek <ankitapareek@microsoft.com> - 4.19.0-2
62+
- Address CVE-2024-12133
63+
6064
* Tue Oct 25 2022 Pawel Winogrodzki <pawelwi@microsoft.com> - 4.19.0-1
6165
- Updating to version 4.19.0 to fix CVE-2021-46848.
6266

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ mariner-repos-shared-2.0-9.cm2.noarch.rpm
228228
mariner-repos-2.0-9.cm2.noarch.rpm
229229
libffi-3.4.2-3.cm2.aarch64.rpm
230230
libffi-devel-3.4.2-3.cm2.aarch64.rpm
231-
libtasn1-4.19.0-1.cm2.aarch64.rpm
231+
libtasn1-4.19.0-2.cm2.aarch64.rpm
232232
p11-kit-0.24.1-1.cm2.aarch64.rpm
233233
p11-kit-trust-0.24.1-1.cm2.aarch64.rpm
234234
ca-certificates-shared-2.0.0-19.cm2.noarch.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ mariner-repos-shared-2.0-9.cm2.noarch.rpm
228228
mariner-repos-2.0-9.cm2.noarch.rpm
229229
libffi-3.4.2-3.cm2.x86_64.rpm
230230
libffi-devel-3.4.2-3.cm2.x86_64.rpm
231-
libtasn1-4.19.0-1.cm2.x86_64.rpm
231+
libtasn1-4.19.0-2.cm2.x86_64.rpm
232232
p11-kit-0.24.1-1.cm2.x86_64.rpm
233233
p11-kit-trust-0.24.1-1.cm2.x86_64.rpm
234234
ca-certificates-shared-2.0.0-19.cm2.noarch.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -204,9 +204,9 @@ libssh2-debuginfo-1.9.0-4.cm2.aarch64.rpm
204204
libssh2-devel-1.9.0-4.cm2.aarch64.rpm
205205
libstdc++-11.2.0-8.cm2.aarch64.rpm
206206
libstdc++-devel-11.2.0-8.cm2.aarch64.rpm
207-
libtasn1-4.19.0-1.cm2.aarch64.rpm
208-
libtasn1-debuginfo-4.19.0-1.cm2.aarch64.rpm
209-
libtasn1-devel-4.19.0-1.cm2.aarch64.rpm
207+
libtasn1-4.19.0-2.cm2.aarch64.rpm
208+
libtasn1-debuginfo-4.19.0-2.cm2.aarch64.rpm
209+
libtasn1-devel-4.19.0-2.cm2.aarch64.rpm
210210
libtool-2.4.6-8.cm2.aarch64.rpm
211211
libtool-debuginfo-2.4.6-8.cm2.aarch64.rpm
212212
libxml2-2.10.4-6.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -210,9 +210,9 @@ libssh2-debuginfo-1.9.0-4.cm2.x86_64.rpm
210210
libssh2-devel-1.9.0-4.cm2.x86_64.rpm
211211
libstdc++-11.2.0-8.cm2.x86_64.rpm
212212
libstdc++-devel-11.2.0-8.cm2.x86_64.rpm
213-
libtasn1-4.19.0-1.cm2.x86_64.rpm
214-
libtasn1-debuginfo-4.19.0-1.cm2.x86_64.rpm
215-
libtasn1-devel-4.19.0-1.cm2.x86_64.rpm
213+
libtasn1-4.19.0-2.cm2.x86_64.rpm
214+
libtasn1-debuginfo-4.19.0-2.cm2.x86_64.rpm
215+
libtasn1-devel-4.19.0-2.cm2.x86_64.rpm
216216
libtool-2.4.6-8.cm2.x86_64.rpm
217217
libtool-debuginfo-2.4.6-8.cm2.x86_64.rpm
218218
libxml2-2.10.4-6.cm2.x86_64.rpm

0 commit comments

Comments
 (0)