TUCoPS :: Unix :: General
:: unix5034.htm
rsync remote heap corruption
28th Jan 2002 [SBWID-5034]
COMMAND
rsync remote heap corruption
SYSTEMS AFFECTED
rsync < 2.3.2-1.3
PROBLEM
Sebastian Krahmer from SuSe [http://www.suse.com] found :
They are several places in rsync where signed and unsigned numbers are
mixed which could be exploited by setting arguments to negative values.
This could be abused by remote users to write 0-bytes in rsync\'s
memory and trick rsync into executing arbitrary code.
No more details where provided, see diff below for better
comprehension.
SOLUTION
--- rsync-2.3.2.orig/receiver.c
+++ rsync-2.3.2/receiver.c
@@ -200,7 +200,8 @@
static int receive_data(int f_in,struct map_struct *buf,int fd,char *fname,
OFF_T total_size)
{
- int i,n,remainder,len,count;
+ int i;
+ unsigned int n,remainder,len,count;
OFF_T offset = 0;
OFF_T offset2;
char *data;
--- rsync-2.3.2.orig/io.c
+++ rsync-2.3.2/io.c
@@ -75,7 +75,7 @@
/* read from a socket with IO timeout. return the number of
bytes read. If no bytes can be read then exit, never return
a number <= 0 */
-static int read_timeout(int fd, char *buf, int len)
+static int read_timeout(int fd, char *buf, size_t len)
{
int n, ret=0;
@@ -137,7 +137,7 @@
/* continue trying to read len bytes - don\'t return until len
has been read */
-static void read_loop(int fd, char *buf, int len)
+static void read_loop(int fd, char *buf, size_t len)
{
while (len) {
int n = read_timeout(fd, buf, len);
@@ -150,7 +150,7 @@
/* read from the file descriptor handling multiplexing -
return number of bytes read
never return <= 0 */
-static int read_unbuffered(int fd, char *buf, int len)
+static int read_unbuffered(int fd, char *buf, size_t len)
{
static int remaining;
char ibuf[4];
@@ -237,7 +237,7 @@
/* do a buffered read from fd. don\'t return until all N bytes
have been read. If all N can\'t be read then exit with an error */
-static void readfd(int fd,char *buffer,int N)
+static void readfd(int fd,char *buffer,size_t N)
{
int ret;
int total=0;
@@ -303,12 +303,12 @@
return ret;
}
-void read_buf(int f,char *buf,int len)
+void read_buf(int f,char *buf,size_t len)
{
readfd(f,buf,len);
}
-void read_sbuf(int f,char *buf,int len)
+void read_sbuf(int f,char *buf,size_t len)
{
read_buf(f,buf,len);
buf[len] = 0;
@@ -326,7 +326,7 @@
/* write len bytes to fd, possibly reading from buffer_f_in if set
in order to unclog the pipe. don\'t return until all len
bytes have been written */
-static void writefd_unbuffered(int fd,char *buf,int len)
+static void writefd_unbuffered(int fd,char *buf,size_t len)
{
int total = 0;
fd_set w_fds, r_fds;
@@ -439,7 +439,7 @@
}
}
-static void writefd(int fd,char *buf,int len)
+static void writefd(int fd,char *buf,size_t len)
{
stats.total_written += len;
@@ -486,7 +486,7 @@
writefd(f,b,8);
}
-void write_buf(int f,char *buf,int len)
+void write_buf(int f,char *buf,size_t len)
{
writefd(f,buf,len);
}
@@ -503,7 +503,7 @@
write_buf(f,(char *)&c,1);
}
-int read_line(int f, char *buf, int maxlen)
+int read_line(int f, char *buf, size_t maxlen)
{
eof_error = 0;
@@ -570,7 +570,7 @@
}
/* write an message to the error stream */
-int io_multiplex_write(int f, char *buf, int len)
+int io_multiplex_write(int f, char *buf, size_t len)
{
if (!io_multiplexing_out) return 0;
--- rsync-2.3.2.orig/Makefile.in
+++ rsync-2.3.2/Makefile.in
@@ -41,14 +41,14 @@
install: all
-mkdir -p ${bindir}
- ${INSTALLCMD} -m 755 rsync ${bindir}
+ ${INSTALLCMD} ${STRIP_OPT} -m 755 rsync ${bindir}
-mkdir -p ${mandir}/man1
-mkdir -p ${mandir}/man5
${INSTALLCMD} -m 644 $(srcdir)/rsync.1 ${mandir}/man1
${INSTALLCMD} -m 644 $(srcdir)/rsyncd.conf.5 ${mandir}/man5
install-strip:
- $(MAKE) INSTALLCMD=\'$(INSTALLCMD) -s\' install
+ $(MAKE) STRIP_OPT=\'-s\' install
rsync: $(OBJS)
$(CC) $(CFLAGS) $(LDFLAGS) -o rsync $(OBJS) $(LIBS)
@@ -66,7 +66,7 @@
rm -f *~ $(OBJS) rsync
distclean: clean
- rm -f config.h config.cache config.status Makefile
+ rm -f config.h config.cache config.status config.log Makefile
# this target is really just for my use. It only works on a limited
--- rsync-2.3.2.orig/exclude.c
+++ rsync-2.3.2/exclude.c
@@ -298,7 +298,8 @@
void recv_exclude_list(int f)
{
char line[MAXPATHLEN];
- int l;
+ unsigned int l;
+
while ((l=read_int(f))) {
if (l>= MAXPATHLEN) overflow(\"recv_exclude_list\");
read_sbuf(f,line,l);
--- rsync-2.3.2.orig/util.c
+++ rsync-2.3.2/util.c
@@ -229,7 +229,7 @@
derived from GNU C\'s cccp.c.
*/
-static int full_write(int desc, char *ptr, int len)
+static int full_write(int desc, char *ptr, size_t len)
{
int total_written;
@@ -255,11 +255,11 @@
for an error.
derived from GNU C\'s cccp.c. */
-static int safe_read(int desc, char *ptr, int len)
+static int safe_read(int desc, char *ptr, size_t len)
{
int n_chars;
- if (len <= 0)
+ if (len == 0)
return len;
#ifdef EINTR
--- rsync-2.3.2.orig/fileio.c
+++ rsync-2.3.2/fileio.c
@@ -36,7 +36,7 @@
}
-static int write_sparse(int f,char *buf,int len)
+static int write_sparse(int f,char *buf,size_t len)
{
int l1=0,l2=0;
int ret;
@@ -69,7 +69,7 @@
-int write_file(int f,char *buf,int len)
+int write_file(int f,char *buf,size_t len)
{
int ret = 0;
--- rsync-2.3.2.orig/loadparm.c
+++ rsync-2.3.2/loadparm.c
@@ -150,7 +150,7 @@
False, /* transfer logging */
False, /* ignore errors */
\"nobody\",/* uid */
- \"nobody\",/* gid */
+ \"nogroup\",/* gid */
NULL, /* hosts allow */
NULL, /* hosts deny */
NULL, /* auth users */
--- rsync-2.3.2.orig/rsync.h
+++ rsync-2.3.2/rsync.h
@@ -323,9 +323,9 @@
struct sum_struct {
OFF_T flength; /* total file length */
- int count; /* how many chunks */
- int remainder; /* flength % block_length */
- int n; /* block_length */
+ size_t count; /* how many chunks */
+ size_t remainder; /* flength % block_length */
+ size_t n; /* block_length */
struct sum_buf *sums; /* points to info for each chunk */
};
--- rsync-2.3.2.orig/flist.c
+++ rsync-2.3.2/flist.c
@@ -282,7 +282,7 @@
static gid_t last_gid;
static char lastname[MAXPATHLEN];
char thisname[MAXPATHLEN];
- int l1=0,l2=0;
+ unsigned int l1=0,l2=0;
char *p;
struct file_struct *file;
@@ -345,6 +345,10 @@
if (preserve_links && S_ISLNK(file->mode)) {
int l = read_int(f);
+ if (l < 0) {
+ rprintf(FERROR,\"overflow: l=%d\\n\", l);
+ overflow(\"receive_file_entry\");
+ }
file->link = (char *)malloc(l+1);
if (!file->link) out_of_memory(\"receive_file_entry 2\");
read_sbuf(f,file->link,l);
--- rsync-2.3.2.orig/generator.c
+++ rsync-2.3.2/generator.c
@@ -192,7 +192,7 @@
/* if the file exists already and we aren\'t perserving
presmissions then act as though the remote end sent
us the file permissions we already have */
- file->mode = st.st_mode;
+ file->mode = (file->mode & _S_IFMT) | (st.st_mode & ~_S_IFMT);
}
if (S_ISDIR(file->mode)) {
--- rsync-2.3.2.orig/log.c
+++ rsync-2.3.2/log.c
@@ -192,6 +192,8 @@
extern int am_daemon;
int64 b;
+ memset(buf,0,sizeof(buf));
+
strlcpy(buf, format, sizeof(buf));
for (s=&buf[0];
@@ -253,7 +255,7 @@
l = strlen(n);
- if ((l-1) + ((int)(s - &buf[0]))> sizeof(buf)) {
+ if (l + ((int)(s - &buf[0]))> sizeof(buf)) {
rprintf(FERROR,\"buffer overflow expanding %%%c - exiting\\n\",
p[0]);
exit_cleanup(RERR_MESSAGEIO);
--- rsync-2.3.2.orig/version.h
+++ rsync-2.3.2/version.h
@@ -1 +1 @@
-#define VERSION \"2.3.2\"
+#define VERSION \"2.3.3pre1\"
--- rsync-2.3.2.orig/proto.h
+++ rsync-2.3.2/proto.h
@@ -36,7 +36,7 @@
void add_include_line(char *p);
void add_cvs_excludes(void);
int sparse_end(int f);
-int write_file(int f,char *buf,int len);
+int write_file(int f,char *buf,size_t len);
struct map_struct *map_file(int fd,OFF_T len);
char *map_ptr(struct map_struct *map,OFF_T offset,int len);
void unmap_file(struct map_struct *map);
@@ -58,21 +58,21 @@
void setup_readbuffer(int f_in);
int32 read_int(int f);
int64 read_longint(int f);
-void read_buf(int f,char *buf,int len);
-void read_sbuf(int f,char *buf,int len);
+void read_buf(int f,char *buf,size_t len);
+void read_sbuf(int f,char *buf,size_t len);
unsigned char read_byte(int f);
void io_start_buffering(int fd);
void io_flush(void);
void io_end_buffering(int fd);
void write_int(int f,int32 x);
void write_longint(int f, int64 x);
-void write_buf(int f,char *buf,int len);
+void write_buf(int f,char *buf,size_t len);
void write_byte(int f,unsigned char c);
-int read_line(int f, char *buf, int maxlen);
+int read_line(int f, char *buf, size_t maxlen);
void io_printf(int fd, const char *format, ...);
void io_start_multiplex_out(int fd);
void io_start_multiplex_in(int fd);
-int io_multiplex_write(int f, char *buf, int len);
+int io_multiplex_write(int f, char *buf, size_t len);
void io_close_input(int fd);
char *lp_motd_file(void);
char *lp_log_file(void);
--- rsync-2.3.2.orig/NEWS
+++ rsync-2.3.2/NEWS
@@ -0,0 +1,7 @@
+rsync 2.3.3
+
+ SECURITY FIXES:
+
+ * Signedness security patch from Sebastian Krahmer
+ <krahmer@suse.de> -- in some cases we were not sufficiently
+ careful about reading integers from the network.
--- rsync-2.3.2.orig/debian/dirs
+++ rsync-2.3.2/debian/dirs
@@ -0,0 +1,4 @@
+usr/bin
+usr/doc/rsync
+usr/man/man1
+usr/lib/debian-test/tests
--- rsync-2.3.2.orig/debian/rules
+++ rsync-2.3.2/debian/rules
@@ -0,0 +1,59 @@
+#!/usr/bin/make -f
+# debian.rules file - for rsync 1.7.2
+# Copyright 1996 by Philip Hands.
+# Based on the sample debian.rules file - for GNU Hello (1.3).
+# Copyright 1994,1995 by Ian Jackson.
+# I hereby give you perpetual unlimited permission to copy,
+# modify and relicense this file, provided that you do not remove
+# my name from the file itself. (I assert my moral right of
+# paternity under the Copyright, Designs and Patents Act 1988.)
+
+SHELL = /bin/bash
+BINS = rsync
+
+build:
+ ./configure --prefix=/usr --mandir=\'$${prefix}/share/man\'
+ $(MAKE)
+ touch build
+
+clean: checkdir
+ -rm -f build
+ -$(MAKE) -i distclean || $(MAKE) -f Makefile.in distclean
+ -rm -rf *~ debian/tmp debian/*~ debian/*.bak debian/files* debian/substvars
+ -rm -f lib/dummy zlib/dummy
+
+binary-indep: checkroot build
+# nothing to do
+
+binary-arch: checkroot build
+ -rm -rf debian/tmp
+ install -d debian/tmp \\
+ debian/tmp/DEBIAN \\
+ debian/tmp/usr/bin \\
+ debian/tmp/usr/share/doc/rsync \\
+ debian/tmp/usr/share/man/man1 \\
+ debian/tmp/usr/lib/debian-test/tests
+ $(MAKE) install-strip prefix=`pwd`/debian/tmp/usr exec_prefix=`pwd`/debian/tmp/usr
+ install -m 0644 debian/changelog debian/tmp/usr/share/doc/rsync/changelog.Debian
+ install -m 0644 README tech_report.tex debian/tmp/usr/share/doc/rsync/
+ gzip -9fr `find debian/tmp/usr/share/doc/ debian/tmp/usr/share/man/ -type f`
+ install -m 0644 debian/copyright debian/tmp/usr/share/doc/rsync/copyright
+ install -m 0755 test.sh debian/tmp/usr/lib/debian-test/tests/rsync
+ install -m 0755 debian/postinst debian/prerm debian/tmp/DEBIAN
+ dpkg-shlibdeps $(BINS)
+ dpkg-gencontrol
+ chown -R root.root debian/tmp
+ chmod -R go=rX debian/tmp
+ dpkg --build debian/tmp ..
+
+# Below here is fairly generic really
+
+binary: binary-indep binary-arch
+
+checkdir:
+ @test -f rsync.c -a -f debian/rules
+
+checkroot: checkdir
+ @test 0 = `id -u` || { echo \"Error: not super-user\"; exit 1; }
+
+.PHONY: binary binary-arch binary-indep clean checkroot checkdir
--- rsync-2.3.2.orig/debian/copyright
+++ rsync-2.3.2/debian/copyright
@@ -0,0 +1,24 @@
+This is Debian/GNU Linux\'s prepackaged version of Andrew Tridgell and
+Paul Mackerras\' rsync utility. This package provides the rsync program,
+which is a replacement for rcp that uses the rsync algorythm to
+transfer only the differences between two sets of files.
+
+This package was put together by Philip Hands <phil@hands.com>,
+from sources obtained from:
+ http://rsync.samba.org/ftp/rsync/rsync-2.3.2.tar.gz
+
+The changes were very minimal - merely adding support for the Debian
+package maintenance scheme, by adding various debian/* files, and
+tweaking the Makefile.in to allow the install prefix to be changed.
+
+
+
+COPYRIGHT
+---------
+
+Rsync was written by Andrew Tridgell and Paul Mackerras, and is
+available under the GPL.
+
+Andrew.Tridgell@anu.edu.au
+paulus@cs.anu.edu.au
+
--- rsync-2.3.2.orig/debian/changelog
+++ rsync-2.3.2/debian/changelog
@@ -0,0 +1,223 @@
+rsync (2.3.2-1.3) stable; urgency=high
+
+ * non-maintainer release by security team
+ * Apply patch to fix signed/unsigned problems
+
+ -- Wichert Akkerman <wakkerma@debian.org> 2002年1月26日 01:32:44 +0100
+
+rsync (2.3.2-1.2) frozen unstable; urgency=low
+
+ * Apply patch from Jason Gunthorpe, to fix rsync segfaults. Closes:
+ #51705, #54850.
+
+ -- Adam Heath <doogie@debian.org> 2000年1月20日 00:31:00 -0600
+
+rsync (2.3.2-1.1) unstable; urgency=low
+
+ * Use rsync zlib again (closes:Bug#50248).
+
+ -- Joel Klecker <espy@debian.org> Tue, 7 Dec 1999 09:46:25 -0800
+
+rsync (2.3.2-1) unstable; urgency=low
+
+ * New upstream release
+ * use zlib from zlib1g-dev (closes: 38273)
+ * switch to using /usr/share for docs, and add compatibility /usr/doc link
+
+ -- Philip Hands <phil@hands.com> 1999年11月11日 15:30:14 +0000
+
+rsync (2.3.1-2) unstable; urgency=low
+
+ * apply Patrik Rak\'s fix for directory atribute setting (closes: #36179)
+
+ -- Philip Hands <phil@hands.com> 1999年5月10日 12:24:16 +0100
+
+rsync (2.3.1-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> Sat, 8 May 1999 10:53:53 +0100
+
+rsync (2.3.0-1) unstable; urgency=low
+
+ * New upstream release
+ * change rsyncd\'s default group to ``nogroup\'\' (closes: #25299)
+
+ -- Philip Hands <phil@hands.com> 1999年3月16日 12:22:05 +0000
+
+rsync (2.2.1-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> Sun, 6 Dec 1998 11:14:23 +0000
+
+rsync (2.2.0-2) unstable; urgency=low
+
+ * check if local ssh conections are allowed before using it as part of the
+ test script.
+
+ -- Philip Hands <phil@hands.com> Fri, 6 Nov 1998 10:23:07 +0000
+
+rsync (2.2.0-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> Thu, 5 Nov 1998 15:47:05 +0000
+
+rsync (2.1.1-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1998年9月17日 17:35:41 +0100
+
+rsync (2.1.0-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1998年7月20日 11:52:26 +0100
+
+rsync (2.0.19-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1998年7月18日 01:19:18 +0100
+
+rsync (2.0.18-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1998年6月18日 15:52:11 +0100
+
+rsync (2.0.16-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> Mon, 1 Jun 1998 15:04:58 +0100
+
+rsync (2.0.14-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1998年5月29日 15:26:18 +0100
+
+rsync (2.0.13-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1998年5月28日 01:17:34 +0100
+
+rsync (2.0.12-1) unstable; urgency=high
+
+ * New upstream release
+ (fixes bug that could result in loss of data in files stored in deep
+ directory trees i.e. with path names of more than 255 characters)
+
+ -- Philip Hands <phil@hands.com> 1998年5月26日 18:12:14 +0100
+
+rsync (2.0.11-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1998年5月23日 12:00:28 +0100
+
+rsync (2.0.10-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1998年5月20日 01:58:45 +0100
+
+rsync (2.0.9-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1998年5月18日 15:44:56 +0100
+
+rsync (2.0.3-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1998年5月15日 09:47:18 +0100
+
+rsync (2.0.0-1) unstable; urgency=low
+
+ * New upstream release
+ (this includes the new --daemon code, which needs testing, so consider
+ this to be beta software, and use with care)
+
+ The alpha version that I released a couple of days ago,
+ is incompatible with this version, and should be discarded.
+
+ -- Philip Hands <phil@hands.com> 1998年5月14日 11:22:25 +0100
+
+rsync (1.7.4-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1998年4月17日 10:50:44 +0100
+
+rsync (1.7.2-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> Thu, 9 Apr 1998 10:19:08 +0100
+
+rsync (1.7.1-0bo1) bo-unstable; urgency=low
+
+ * recompiled for libc5
+
+ -- Philip Hands <phil@hands.com> 1998年3月26日 10:27:48 +0000
+
+rsync (1.7.1-1) unstable; urgency=low
+
+ * New upstream release (closes: #16181 #16860)
+ * Fixed typo in description (closes: #18948)
+ * add /usr/doc/rsync/test.sh
+
+ -- Philip Hands <phil@hands.com> 1998年3月26日 09:35:24 +0000
+
+rsync (1.6.9-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1998年1月13日 17:16:06 +0000
+
+rsync (1.6.8-2) unstable; urgency=low
+
+ * Add upstream patch to fix --suffix option
+ (From Andrew Tridgell on the rsync mailing list)
+
+ -- Philip Hands <phil@hands.com> 1997年12月30日 10:54:57 +0000
+
+rsync (1.6.8-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1997年12月29日 10:46:41 +0000
+
+rsync (1.6.7-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1997年12月17日 09:04:16 +0000
+
+rsync (1.6.3-2) unstable; urgency=low
+
+ * recompile with libc6
+
+ -- Philip Hands <phil@hands.com> 1997年8月20日 10:21:04 +0100
+
+rsync (1.6.3-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Philip Hands <phil@hands.com> 1997年4月22日 15:17:38 +0100
+
+rsync (1.6.2-1) unstable; urgency=low
+
+ * Initial Release
+
+ -- Philip Hands <phil@hands.com> Wed, 9 Oct 1996 23:45:08 +0100
+
+Local variables:
+mode: debian-changelog
+End:
--- rsync-2.3.2.orig/debian/control
+++ rsync-2.3.2/debian/control
@@ -0,0 +1,18 @@
+Source: rsync
+Section: net
+Priority: optional
+Maintainer: Philip Hands <phil@hands.com>
+Standards-Version: 3.0.0
+
+Package: rsync
+Architecture: any
+Depends: ${shlibs:Depends}
+Suggests: ssh
+Description: fast remote file copy program (like rcp)
+ rsync is a program that allows files to be copied to and from remote
+ machines in much the same way as rcp. It has many more options than
+ rcp, and uses the rsync remote-update protocol to greatly speedup
+ file transfers when the destination file already exists.
+ .
+ The rsync remote-update protocol allows rsync to transfer just the
+ differences between two sets of files across the network link.
--- rsync-2.3.2.orig/debian/prerm
+++ rsync-2.3.2/debian/prerm
@@ -0,0 +1,6 @@
+#!/bin/sh
+# prerm for rsync
+
+if [ \\( \"1ドル\" = \"upgrade\" -o \"1ドル\" = \"remove\" \\) -a -L /usr/doc/rsync ]; then
+ rm -f /usr/doc/rsync
+fi
--- rsync-2.3.2.orig/debian/postinst
+++ rsync-2.3.2/debian/postinst
@@ -0,0 +1,8 @@
+#!/bin/sh
+# postinst for rsync
+
+if [ \"1ドル\" = \"configure\" ]; then
+ if [ -d /usr/doc -a ! -e /usr/doc/rsync -a -d /usr/share/doc/rsync ]; then
+ ln -sf ../share/doc/rsync /usr/doc/rsync
+ fi
+fi