mirror of
https://github.com/home-assistant/operating-system.git
synced 2025-11-16 06:09:26 +00:00
f358f322da
* Rebase patches to Buildroot 2021.02-rc3 * Update Buildroot to 2021.02-rc3 * Declare Kernel headers to be Linux version 5.10 (since they are, and new Buildroot knows about 5.10)
68 lines
2.9 KiB
Diff
68 lines
2.9 KiB
Diff
From f27c12d491955c94583512603bf32c4568f20929 Mon Sep 17 00:00:00 2001
|
|
From: Michael Walz <code@serpedon.de>
|
|
Date: Tue, 2 Feb 2021 00:50:29 +0100
|
|
Subject: [PATCH] Store a copy of each serialized shared_ptr within the archive
|
|
to prevent the shared_ptr to be freed to early. (#667)
|
|
|
|
The archives use the memory address pointed by the shared_ptr as a
|
|
unique id which must not be reused during lifetime of the archive.
|
|
Therefore, the archives stores a copy of it.
|
|
This problem was also reported as CVE-2020-11105.
|
|
|
|
[Retrieved from:
|
|
https://github.com/USCiLab/cereal/commit/f27c12d491955c94583512603bf32c4568f20929]
|
|
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
|
|
---
|
|
include/cereal/cereal.hpp | 13 +++++++++++--
|
|
include/cereal/types/memory.hpp | 2 +-
|
|
2 files changed, 12 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/include/cereal/cereal.hpp b/include/cereal/cereal.hpp
|
|
index 99bed9d6..f0d15e8b 100644
|
|
--- a/include/cereal/cereal.hpp
|
|
+++ b/include/cereal/cereal.hpp
|
|
@@ -369,12 +369,17 @@ namespace cereal
|
|
point to the same data.
|
|
|
|
@internal
|
|
- @param addr The address (see shared_ptr get()) pointed to by the shared pointer
|
|
+ @param sharedPointer The shared pointer itself (the adress is taked via get()).
|
|
+ The archive takes a copy to prevent the memory location to be freed
|
|
+ as long as the address is used as id. This is needed to prevent CVE-2020-11105.
|
|
@return A key that uniquely identifies the pointer */
|
|
- inline std::uint32_t registerSharedPointer( void const * addr )
|
|
+ inline std::uint32_t registerSharedPointer(const std::shared_ptr<const void>& sharedPointer)
|
|
{
|
|
+ void const * addr = sharedPointer.get();
|
|
+
|
|
// Handle null pointers by just returning 0
|
|
if(addr == 0) return 0;
|
|
+ itsSharedPointerStorage.push_back(sharedPointer);
|
|
|
|
auto id = itsSharedPointerMap.find( addr );
|
|
if( id == itsSharedPointerMap.end() )
|
|
@@ -645,6 +650,10 @@ namespace cereal
|
|
//! Maps from addresses to pointer ids
|
|
std::unordered_map<void const *, std::uint32_t> itsSharedPointerMap;
|
|
|
|
+ //! Copy of shared pointers used in #itsSharedPointerMap to make sure they are kept alive
|
|
+ // during lifetime of itsSharedPointerMap to prevent CVE-2020-11105.
|
|
+ std::vector<std::shared_ptr<const void>> itsSharedPointerStorage;
|
|
+
|
|
//! The id to be given to the next pointer
|
|
std::uint32_t itsCurrentPointerId;
|
|
|
|
diff --git a/include/cereal/types/memory.hpp b/include/cereal/types/memory.hpp
|
|
index 59e9da9b..cac1f334 100644
|
|
--- a/include/cereal/types/memory.hpp
|
|
+++ b/include/cereal/types/memory.hpp
|
|
@@ -263,7 +263,7 @@ namespace cereal
|
|
{
|
|
auto & ptr = wrapper.ptr;
|
|
|
|
- uint32_t id = ar.registerSharedPointer( ptr.get() );
|
|
+ uint32_t id = ar.registerSharedPointer( ptr );
|
|
ar( CEREAL_NVP_("id", id) );
|
|
|
|
if( id & detail::msb_32bit )
|