185245 - DecodeDBSubjectEntry needs to protect against reading beyond the end of the dbentry

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Wan-Teh Chang]

In lib/softoken/pcertdb.c, function DecodeDBSubjectEntry,
there is no protection against reading beyond the end of
the dbentry.  Therefore, the code is likely to crash if
the data in the dbentry is corrupted.

Throughout the function, we should check that the offset
of the data we want to read is less than dbentry->len
before we read it.

Comment 1

[Robert Relyea]

Needs to be fixed in NSS 3.8.

Comment 2

[Robert Relyea]

Attachment: Check the length validity before we try to reference it.

Don't read beyond the database buffer, even if the record has been corrrupted.

Comment 3

[Wan-Teh Chang]

Comment on attachment 115944 [details] [diff] [review]
Check the length validity before we try to reference it.

> 	for (i=0; i < entry->nemailAddrs; i++) {
>-	    int nameLen = tmpbuf[0] << 8 | tmpbuf[1];
>+	    int nameLen;
>+	    if (tmpbuf + 2 >= end) {
>+		goto loser;
>+	    }

This check should say "tmpbuf +1 >= end" or "tmpbuf +2 > end".

Comment 4

[Robert Relyea]

Fix checked into trunk.