qbit/xenocara
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

MFC: Use timingsafe_memcmp() to compare MIT-MAGIC-COOKIES

Browse Source 
Advisory X41-2017-001: Multiple Vulnerabilities in X.Org.
This commit is contained in:
matthieu 2017-02-28 18:24:48 +00:00
parent 56a9465c27
commit 9ddca5b541
5 changed files with 56 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
xserver/configure.ac
View File

@ -220,7 +220,8 @@ AC_CHECK_FUNCS([backtrace ffs geteuid getuid issetugid getresuid \
getdtablesize getifaddrs getpeereid getpeerucred getprogname getzoneid \
mmap posix_fallocate seteuid shmctl64 strncasecmp vasprintf vsnprintf \
walkcontext])
AC_REPLACE_FUNCS([reallocarray strcasecmp strcasestr strlcat strlcpy strndup])
AC_REPLACE_FUNCS([reallocarray strcasecmp strcasestr strlcat strlcpy strndup \
timingsafe_memcmp])
AC_CHECK_DECLS([program_invocation_short_name], [], [], [[#include <errno.h>]])

3
xserver/include/dix-config.h.in
View File

@ -232,6 +232,9 @@
/* Define to 1 if you have the <sys/utsname.h> header file. */
#undef HAVE_SYS_UTSNAME_H
/* Define to 1 if you have the `timingsafe_memcmp' function. */
#undef HAVE_TIMINGSAFE_MEMCMP
/* Define to 1 if you have the <tslib.h> header file. */
#undef HAVE_TSLIB_H

5
xserver/include/os.h
View File

@ -597,6 +597,11 @@ extern _X_EXPORT char *
strndup(const char *str, size_t n);
#endif
#ifndef HAVE_TIMINGSAFE_MEMCMP
extern _X_EXPORT int
timingsafe_memcmp(const void *b1, const void *b2, size_t len);
#endif
/* Logging. */
typedef enum _LogParameter {
XLOG_FLUSH,

2
xserver/os/mitauth.c
View File

@ -76,7 +76,7 @@ MitCheckCookie(unsigned short data_length,
for (auth = mit_auth; auth; auth = auth->next) {
if (data_length == auth->len &&
memcmp(data, auth->data, (int) data_length) == 0)
timingsafe_memcmp(data, auth->data, (int) data_length) == 0)
return auth->id;
}
*reason = "Invalid MIT-MAGIC-COOKIE-1 key";

45
xserver/os/timingsafe_memcmp.c Normal file
View File

@ -0,0 +1,45 @@
/*
* Copyright (c) 2014 Google Inc.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include <limits.h>
#include <string.h>
int
timingsafe_memcmp(const void *b1, const void *b2, size_t len)
{
const unsigned char *p1 = b1, *p2 = b2;
size_t i;
int res = 0, done = 0;
for (i = 0; i < len; i++) {
/* lt is -1 if p1[i] < p2[i]; else 0. */
int lt = (p1[i] - p2[i]) >> CHAR_BIT;
/* gt is -1 if p1[i] > p2[i]; else 0. */
int gt = (p2[i] - p1[i]) >> CHAR_BIT;
/* cmp is 1 if p1[i] > p2[i]; -1 if p1[i] < p2[i]; else 0. */
int cmp = lt - gt;
/* set res = cmp if !done. */
res |= cmp & ~done;
/* set done if p1[i] != p2[i]. */
done |= lt | gt;
}
return (res);
}