Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix possible out of bound read in armv8_crc32c #2293

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from

Conversation

w4123
Copy link

@w4123 w4123 commented Jan 16, 2025

The armv8_crc32c function uses ldr to load 4 bytes of data even if the remaining data could be less than 4 bytes. This causes capability bound error.
This error can be triggered, for example, when accessing files in an ext2fs partition, which requires the calculation of crc32.

This piece of code also demonstrates the problem:

#include <stdio.h>
#include <sys/gsb_crc32.h>

int main() {
    unsigned char buf[7];
    printf("%d", armv8_crc32c(0, buf, 7));
}

which prints In-address space security exception (core dumped).

PS: I also wonder if this should be fixed upstream as well.

@bsdjhb
Copy link
Collaborator

bsdjhb commented Jan 23, 2025

This does seem like something that should be upstreamed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants