diff options
| author | Julian Andres Klode <julian.klode@canonical.com> | 2020-10-19 13:22:33 +0200 |
|---|---|---|
| committer | Julian Andres Klode <julian.klode@canonical.com> | 2020-12-09 17:30:43 +0100 |
| commit | d10c68d628fe5342d400a999a6d10c5c7c0cef41 (patch) | |
| tree | f858d3f30db857e847205ff3b31cea886c48a2fe /test/integration | |
| parent | f9a621d335622a8909177f6d347e32e3876fde3f (diff) | |
CVE-2020-27350: arfile: Integer overflow in parsing
GHSL-2020-169: This first hunk adds a check that we have more files
left to read in the file than the size of the member, ensuring that
(a) the number is not negative, which caused the crash here and (b)
ensures that we similarly avoid other issues with trying to read too
much data.
GHSL-2020-168: Long file names are encoded by a special marker in
the filename and then the real filename is part of what is normally
the data. We did not check that the length of the file name is within
the length of the member, which means that we got a overflow later
when subtracting the length from the member size to get the remaining
member size.
The file createdeb-lp1899193.cc was provided by GitHub Security Lab
and reformatted using apt coding style for inclusion in the test
case, both of these issues have an automated test case in
test/integration/test-ubuntu-bug-1899193-security-issues.
LP: #1899193
Diffstat (limited to 'test/integration')
| -rwxr-xr-x | test/integration/test-cve-2020-27350 | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/test/integration/test-cve-2020-27350 b/test/integration/test-cve-2020-27350 new file mode 100755 index 000000000..6ee867bb3 --- /dev/null +++ b/test/integration/test-cve-2020-27350 @@ -0,0 +1,13 @@ +#!/bin/sh +set -e + +TESTDIR="$(readlink -f "$(dirname "$0")")" +. "$TESTDIR/framework" +setupenvironment +configarchitecture "amd64" + +${APTTESTHELPERSBINDIR}/createdeb-cve-2020-27350 crash crash.deb +testequal "E: Invalid archive member header" runapt ${APTTESTHELPERSBINDIR}/testdeb ./crash.deb + +${APTTESTHELPERSBINDIR}/createdeb-cve-2020-27350 loop loop.deb +testequal "E: Invalid archive member header" runapt ${APTTESTHELPERSBINDIR}/testdeb ./loop.deb |