From 3f6ff9b519f3d92dff57793115f19a1c4c3f5cde Mon Sep 17 00:00:00 2001 From: Andrew Lukoshko Date: Fri, 15 Nov 2024 13:29:49 +0000 Subject: [PATCH] Accept as many selectors as the file format allows (fixes CVE-2019-12900 regression) --- ...-selectors-as-the-file-format-allows.patch | 81 +++++++++++++++++++ SPECS/bzip2.spec | 11 ++- 2 files changed, 91 insertions(+), 1 deletion(-) create mode 100644 SOURCES/0001-Accept-as-many-selectors-as-the-file-format-allows.patch diff --git a/SOURCES/0001-Accept-as-many-selectors-as-the-file-format-allows.patch b/SOURCES/0001-Accept-as-many-selectors-as-the-file-format-allows.patch new file mode 100644 index 0000000..ca4c23b --- /dev/null +++ b/SOURCES/0001-Accept-as-many-selectors-as-the-file-format-allows.patch @@ -0,0 +1,81 @@ +From b07b105d1b66e32760095e3602261738443b9e13 Mon Sep 17 00:00:00 2001 +From: Mark Wielaard +Date: Wed, 3 Jul 2019 01:28:11 +0200 +Subject: [PATCH] Accept as many selectors as the file format allows. + +But ignore any larger than the theoretical maximum, BZ_MAX_SELECTORS. + +The theoretical maximum number of selectors depends on the maximum +blocksize (900000 bytes) and the number of symbols (50) that can be +encoded with a different Huffman tree. BZ_MAX_SELECTORS is 18002. + +But the bzip2 file format allows the number of selectors to be encoded +with 15 bits (because 18002 isn't a factor of 2 and doesn't fit in +14 bits). So the file format maximum is 32767 selectors. + +Some bzip2 encoders might actually have written out more selectors +than the theoretical maximum because they rounded up the number of +selectors to some convenient factor of 8. + +The extra 14766 selectors can never be validly used by the decompression +algorithm. So we can read them, but then discard them. + +This is effectively what was done (by accident) before we added a +check for nSelectors to be at most BZ_MAX_SELECTORS to mitigate +CVE-2019-12900. + +The extra selectors were written out after the array inside the +EState struct. But the struct has extra space allocated after the +selector arrays of 18060 bytes (which is larger than 14766). +All of which will be initialized later (so the overwrite of that +space with extra selector values would have been harmless). +--- + compress.c | 2 +- + decompress.c | 10 ++++++++-- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/compress.c b/compress.c +index 237620d..76adee6 100644 +--- a/compress.c ++++ b/compress.c +@@ -454,7 +454,7 @@ void sendMTFValues ( EState* s ) + + AssertH( nGroups < 8, 3002 ); + AssertH( nSelectors < 32768 && +- nSelectors <= (2 + (900000 / BZ_G_SIZE)), ++ nSelectors <= BZ_MAX_SELECTORS, + 3003 ); + + +diff --git a/decompress.c b/decompress.c +index 20ce493..3303499 100644 +--- a/decompress.c ++++ b/decompress.c +@@ -287,7 +287,7 @@ Int32 BZ2_decompress ( DState* s ) + GET_BITS(BZ_X_SELECTOR_1, nGroups, 3); + if (nGroups < 2 || nGroups > BZ_N_GROUPS) RETURN(BZ_DATA_ERROR); + GET_BITS(BZ_X_SELECTOR_2, nSelectors, 15); +- if (nSelectors < 1 || nSelectors > BZ_MAX_SELECTORS) RETURN(BZ_DATA_ERROR); ++ if (nSelectors < 1) RETURN(BZ_DATA_ERROR); + for (i = 0; i < nSelectors; i++) { + j = 0; + while (True) { +@@ -296,8 +296,14 @@ Int32 BZ2_decompress ( DState* s ) + j++; + if (j >= nGroups) RETURN(BZ_DATA_ERROR); + } +- s->selectorMtf[i] = j; ++ /* Having more than BZ_MAX_SELECTORS doesn't make much sense ++ since they will never be used, but some implementations might ++ "round up" the number of selectors, so just ignore those. */ ++ if (i < BZ_MAX_SELECTORS) ++ s->selectorMtf[i] = j; + } ++ if (nSelectors > BZ_MAX_SELECTORS) ++ nSelectors = BZ_MAX_SELECTORS; + + /*--- Undo the MTF values for the selectors. ---*/ + { +-- +2.43.5 + diff --git a/SPECS/bzip2.spec b/SPECS/bzip2.spec index b1d1514..484aae2 100644 --- a/SPECS/bzip2.spec +++ b/SPECS/bzip2.spec @@ -3,7 +3,7 @@ Summary: A file compression utility Name: bzip2 Version: 1.0.6 -Release: 27%{?dist} +Release: 27%{?dist}.alma.1 License: BSD Group: Applications/File URL: http://www.bzip.org/ @@ -19,6 +19,10 @@ Patch3: bzip2-ldflags.patch Patch4: set-out-file-to-null.patch Patch5: decompress-out-of-bounds.patch +# AlmaLinux patches +# https://inbox.sourceware.org/bzip2-devel/20241108214034.GC8315@gnu.wildebeest.org/ +Patch100: 0001-Accept-as-many-selectors-as-the-file-format-allows.patch + %description Bzip2 is a freely available, patent-free, high quality data compressor. Bzip2 compresses files to within 10 to 15 percent of the capabilities @@ -65,6 +69,8 @@ Static libraries for applications using the bzip2 compression format. %patch4 -p1 -b .bzip2recover %patch5 -p1 +%patch100 -p1 + cp -a %{SOURCE1} . sed -i "s|^libdir=|libdir=%{_libdir}|" bzip2.pc @@ -142,6 +148,9 @@ ln -s bzgrep.1 $RPM_BUILD_ROOT%{_mandir}/man1/bzfgrep.1 %{_libdir}/pkgconfig/bzip2.pc %changelog +* Fri Nov 15 2024 Andrew Lukoshko - 1.0.6-27.alma.1 +- Accept as many selectors as the file format allows (fixes CVE-2019-12900 regression) + * Tue Oct 29 2024 Jacek Migacz - 1.0.6-27 - Fixes out of bounds access in BZ2_decompress (RHEL-64929)