[lucy-commits] svn commit: r1165380 - in /incubator/lucy/trunk/core/Lucy: Object/CharBuf.c Test/Util/TestStringHelper.c

[ma...@apache.org]

Author: marvin
Date: Mon Sep  5 18:34:20 2011
New Revision: 1165380

URL: http://svn.apache.org/viewvc?rev=1165380&view=rev
Log:
Insert sanity checks into string processing routines.

Some string processing routines may behave incorrectly when operating on data
which is not well-formed UTF-8.  They are never supposed to see ill-formed
data, but if there is a bug in either Lucy or in an application feeding Lucy,
the possibility exists.

As part of a defense in depth against possible security holes, these routines
should abort when they detect invalid data.  This will turn flaws which
potentially could worsen into severe problems such as buffer overflow
vulnerabilities into at worst denial-of-service vulnerabilities.

Modified:
    incubator/lucy/trunk/core/Lucy/Object/CharBuf.c
    incubator/lucy/trunk/core/Lucy/Test/Util/TestStringHelper.c

Modified: incubator/lucy/trunk/core/Lucy/Object/CharBuf.c
URL: http://svn.apache.org/viewvc/incubator/lucy/trunk/core/Lucy/Object/CharBuf.c?rev=1165380&r1=1165379&r2=1165380&view=diff
==============================================================================
--- incubator/lucy/trunk/core/Lucy/Object/CharBuf.c (original)
+++ incubator/lucy/trunk/core/Lucy/Object/CharBuf.c Mon Sep  5 18:34:20 2011
@@ -620,6 +620,9 @@ CB_trim_top(CharBuf *self) {
         ptr += StrHelp_UTF8_COUNT[*(uint8_t*)ptr];
         count++;
     }
+    if (ptr > end) {
+        DIE_INVALID_UTF8(self->ptr, self->size);
+    }
 
     if (count) {
         // Copy string backwards.
@@ -656,6 +659,9 @@ CB_nip(CharBuf *self, size_t count) {
     for (; ptr < end  && count--; ptr += StrHelp_UTF8_COUNT[*(uint8_t*)ptr]) {
         num_nipped++;
     }
+    if (ptr > end) {
+        DIE_INVALID_UTF8(self->ptr, self->size);
+    }
     self->size = end - ptr;
     memmove(self->ptr, ptr, self->size);
     return num_nipped;
@@ -669,6 +675,9 @@ CB_nip_one(CharBuf *self) {
     else {
         int32_t retval = (int32_t)StrHelp_decode_utf8_char(self->ptr);
         size_t consumed = StrHelp_UTF8_COUNT[*(uint8_t*)self->ptr];
+        if (consumed > self->size) {
+            DIE_INVALID_UTF8(self->ptr, self->size);
+        }
         char *ptr = self->ptr + StrHelp_UTF8_COUNT[*(uint8_t*)self->ptr];
         self->size -= consumed;
         memmove(self->ptr, ptr, self->size);
@@ -698,6 +707,9 @@ CB_length(CharBuf *self) {
         ptr += StrHelp_UTF8_COUNT[*(uint8_t*)ptr];
         len++;
     }
+    if (ptr != end) {
+        DIE_INVALID_UTF8(self->ptr, self->size);
+    }
     return len;
 }
 
@@ -717,7 +729,12 @@ CB_code_point_at(CharBuf *self, size_t t
     char *const end = ptr + self->size;
 
     for (; ptr < end; ptr += StrHelp_UTF8_COUNT[*(uint8_t*)ptr]) {
-        if (count == tick) { return StrHelp_decode_utf8_char(ptr); }
+        if (count == tick) {
+            if (ptr > end) {
+                DIE_INVALID_UTF8(self->ptr, self->size);
+            }
+            return StrHelp_decode_utf8_char(ptr); 
+        }
         count++;
     }
 
@@ -854,6 +871,9 @@ ViewCB_trim_top(ViewCharBuf *self) {
     }
 
     if (count) {
+        if (ptr > end) {
+            DIE_INVALID_UTF8(self->ptr, self->size);
+        }
         self->size = end - ptr;
         self->ptr  = ptr;
     }
@@ -872,6 +892,9 @@ ViewCB_nip(ViewCharBuf *self, size_t cou
         ) {
         num_nipped++;
     }
+    if (ptr > end) {
+        DIE_INVALID_UTF8(self->ptr, self->size);
+    }
     self->size = end - ptr;
     self->ptr  = ptr;
     return num_nipped;
@@ -885,6 +908,9 @@ ViewCB_nip_one(ViewCharBuf *self) {
     else {
         int32_t retval = (int32_t)StrHelp_decode_utf8_char(self->ptr);
         size_t consumed = StrHelp_UTF8_COUNT[*(uint8_t*)self->ptr];
+        if (consumed > self->size) {
+            DIE_INVALID_UTF8(self->ptr, self->size);
+        }
         self->ptr  += consumed;
         self->size -= consumed;
         return retval;

Modified: incubator/lucy/trunk/core/Lucy/Test/Util/TestStringHelper.c
URL: http://svn.apache.org/viewvc/incubator/lucy/trunk/core/Lucy/Test/Util/TestStringHelper.c?rev=1165380&r1=1165379&r2=1165380&view=diff
==============================================================================
--- incubator/lucy/trunk/core/Lucy/Test/Util/TestStringHelper.c (original)
+++ incubator/lucy/trunk/core/Lucy/Test/Util/TestStringHelper.c Mon Sep  5 18:34:20 2011
@@ -106,11 +106,13 @@ test_back_utf8_char(TestBatch *batch) {
               "back_utf8_char");
     TEST_TRUE(batch, StrHelp_back_utf8_char(end, buf) == NULL,
               "back_utf8_char returns NULL rather than back up beyond start");
+    TEST_TRUE(batch, StrHelp_back_utf8_char(buffer, buffer) == NULL,
+              "back_utf8_char returns NULL when end == start");
 }
 
 void
 TestStrHelp_run_tests() {
-    TestBatch *batch = TestBatch_new(43);
+    TestBatch *batch = TestBatch_new(44);
 
     TestBatch_Plan(batch);