pkcs11: bound the config file index in pkcs11_config_load_objects() - #428
Open
learnrahulrai-ui wants to merge 1 commit into
Open
pkcs11: bound the config file index in pkcs11_config_load_objects()#428learnrahulrai-ui wants to merge 1 commit into
learnrahulrai-ui wants to merge 1 commit into
Conversation
Copy link
Copy Markdown
Sorry, something went wrong.
updateConfFileData[] holds MAX_CONF_FILES entries but the index i is never compared against it. A filestore with 17 .conf files stores past the end at :1083; with 16 the array is full, leaving no NULL for the walks at :1114 and :1365, which then read past it. Bound the store and report CKR_HOST_MEMORY rather than dropping files, since which files got dropped would depend on readdir() order. Bound both walks by totalConfFileCount, and increment i only when the allocation succeeded so the two cannot disagree. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
updateConfFileData[MAX_CONF_FILES] is indexed by i, which nothing bounds — MAX_CONF_FILES appears only in its #define and that declaration, never in a comparison.
Under AddressSanitizer at d49c7d5, varying only the number of .conf files in the filestore:
Two defects, not one. At 17 the store writes past the end. At 16 nothing is written out of bounds — the array is merely full, so the NULL that the parse walk and the free walk rely on as a terminator no longer exists. Bounding the store alone leaves 16 broken, so both walks are bounded by totalConfFileCount too.
16 is a normal configuration, not a crafted one: a slot with N objects is 1 + N files (0.conf plus 0.<handle>.conf), so the default PKCS11_MAX_OBJECTS_ALLOWED=16 needs 17.
i++ also moves inside the allocation-success branch, so i and totalConfFileCount cannot diverge; on a failed malloc the old code left a NULL hole that truncates one consumer loop and is dereferenced by the other.
To reproduce: put 0.conf and 0.2.conf … 0.17.conf in a filestore and call C_Initialize() on a build with -fsanitize=address.
Open question: MAX_CONF_FILES is PKCS11_MAX_SLOTS_ALLOWED * PKCS11_MAX_OBJECTS_ALLOWED, counting neither the per-slot base file nor the NULL these loops need. Resizing it changes stack usage on embedded targets, so this patch only bounds the index — happy to follow up with the resize if you would prefer that.
Checklist