330900 - nsCrypto::GenerateCRMFRequest reads past end of array when given 2 args

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Marking this security-sensitive mainly because I discovered it while looking at bug 330897, and the reverse is therefore also reasonably likely, not because I think it's exploitable (although it's possible that it is, although I think unlikely).

nsCrypto::GenerateCRMFRequest intends to allow a number of arguments that is 5, 8, 11, 14, etc.  But it doesn't give an error if it's given 2 arguments, which could cause it to read past the end of an array.

I haven't tried writing a testcase for this yet, though.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

Comment 2

[Martijn Wargers (dead)]

I guess this would also fix bug 327524, right?

Comment 3

[Kai Engert (:KaiE:)]

Comment on attachment 215468 [details] [diff] [review]
patch

r=kengert

Thanks for the patch.

The documentation for this function is here:
http://developer.mozilla.org/en/docs/generateCRMFRequest

Note that calling this function does not make much sense if one supplies 5 parameters, the smallest amount of reasonable parameters is 8.

The documentation page requests that after the first 5 params, there must be "one or more sets" of additional params.

So I think it's ok if we require to supply at least 8 params.

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 215468 [details] [diff] [review]
patch

sr=jst

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fix checked in to trunk and MOZILLA_1_8_BRANCH.

Comment 6

[Daniel Veditz [:dveditz]]

Not sure the severity here. I suppose it depends on where the data beyond the array comes from (user controlled?).

Comment 7

[Darin Fisher]

kaie: can you explain how this problem could be exploited?  thanks!

Comment 8

[Kai Engert (:KaiE:)]

This bug occurrs when using the function with an invalid number of parameters.

This function is not called from within our own code, but only if a web page calls it.

I don't know how a web site page can influence the data past the array, will it just read the bytes that follow the javascript code in the web page?

Comment 9

[Daniel Veditz [:dveditz]]

Comment on attachment 215468 [details] [diff] [review]
patch

approved for 1.8.0 branch, a=dveditz for drivers

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fix checked in to MOZILLA_1_8_0_BRANCH.

Comment 11

[Jay Patel [:jay]]

v.fixed on 1.8.0 branch: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8.0.2) Gecko/20060420 Firefox/1.5.0.2, based on code inspection and comments in this bug.

Adding [need testcase].  If anyone does get a testcase together, we can test to double check the fix.

Comment 12

[Martijn Wargers (dead)]

Bug 327524 has a testcase that is fixed by this patch.

Comment 13

[Frederic Crozat]

could you backport this patch to firefox 1.0.x branch please ?

I can confirm it fixes crash from testcase in bug #327524.