From d3a528c788ba9e531fab91db41d3a833c54da325 Mon Sep 17 00:00:00 2001 From: Jacek Tomasiak Date: Thu, 12 May 2022 13:02:47 +0200 Subject: [PATCH] Fix CVE-2022-24795 (from brianmario/yajl-ruby) The buffer reallocation could cause heap corruption because of `need` overflow for large inputs. In addition, there's a possible infinite loop in case `need` reaches zero. The fix is to `abort()` if the loop ends with lower value of `need` than when it started. --- src/yajl_buf.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) Index: yajl-2.1.0/src/yajl_buf.c =================================================================== diff -up yajl-2.1.0/src/yajl_buf.c.CVE-2022-24795 yajl-2.1.0/src/yajl_buf.c --- yajl-2.1.0/src/yajl_buf.c.CVE-2022-24795 2024-01-05 14:37:48.291676702 +0100 +++ yajl-2.1.0/src/yajl_buf.c 2024-01-05 14:38:48.088674110 +0100 @@ -45,7 +45,16 @@ int yajl_buf_ensure_available(yajl_buf b need = buf->len; - while (want >= (need - buf->used)) need <<= 1; + while (need > 0 && want >= (need - buf->used)) { + /* this eventually "overflows" to zero */ + need <<= 1; + } + + /* overflow */ + if (need < buf->len) { + abort(); + } + if (need < buf->used) { return -1; }