Apply patch from xen repository, fixing CVE-2011-1583

3 files changed, 254 insertions, 3 deletions

diff --git a/sysutils/xentools41/Makefile b/sysutils/xentools41/Makefile
index 806302af445..6572b5832b6 100644
--- a/sysutils/xentools41/Makefile
+++ b/sysutils/xentools41/Makefile
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.6 2011/05/07 18:39:05 tnn Exp $
+# $NetBSD: Makefile,v 1.7 2011/05/12 15:57:38 bouyer Exp $
 #
 VERSION=		4.1.0
 DISTNAME=		xen-${VERSION}
 PKGNAME=		xentools41-${VERSION}
-PKGREVISION=		3
+PKGREVISION=		4
 CATEGORIES=		sysutils
 MASTER_SITES=	http://bits.xensource.com/oss-xen/release/${VERSION}/
 
diff --git a/sysutils/xentools41/distinfo b/sysutils/xentools41/distinfo
index ccd29f2b556..22a20445e3a 100644
--- a/sysutils/xentools41/distinfo
+++ b/sysutils/xentools41/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.5 2011/05/07 18:39:05 tnn Exp $
+$NetBSD: distinfo,v 1.6 2011/05/12 15:57:38 bouyer Exp $
 
 SHA1 (ipxe-git-v1.0.0.tar.gz) = da052c8de5f3485fe0253c19cf52ed6d72528485
 RMD160 (ipxe-git-v1.0.0.tar.gz) = dcd9b6eaafa1ce05c1ebf2a15f2f73ad7a8c5547
@@ -6,6 +6,7 @@ Size (ipxe-git-v1.0.0.tar.gz) = 1996881 bytes
 SHA1 (xen-4.1.0.tar.gz) = 4295e67524746ce155ff991db5fd2a611be27f67
 RMD160 (xen-4.1.0.tar.gz) = e9ef987b24503d6c993bccfd203be5af9f104f48
 Size (xen-4.1.0.tar.gz) = 10348539 bytes
+SHA1 (patch-CVE-2011-1583) = adbe2e6d2bc89cfdfb44ff8011e29f1d128fd820
 SHA1 (patch-aa) = 9b53ba4a809dad7a1de34c8fa0dbe493d7256ada
 SHA1 (patch-ab) = 0906a5ec3a7450fc987b01289e2560e60966d00d
 SHA1 (patch-ac) = c3cc5335a1d6b066307c5f03fe72f513a9eb2bdb
diff --git a/sysutils/xentools41/patches/patch-CVE-2011-1583 b/sysutils/xentools41/patches/patch-CVE-2011-1583
new file mode 100644
index 00000000000..8baa77d9f45
--- /dev/null
+++ b/sysutils/xentools41/patches/patch-CVE-2011-1583
@@ -0,0 +1,250 @@
+$NetBSD: patch-CVE-2011-1583,v 1.1 2011/05/12 15:57:38 bouyer Exp $
+
+from:
+http://xenbits.xensource.com/hg/staging/xen-4.1-testing.hg/rev/e2e575f8b5d9
+
+# HG changeset patch
+# User Ian Jackson <ian.jackson@eu.citrix.com>
+# Date 1304949841 -3600
+# Node ID e2e575f8b5d961db23ea8bb7b3820be8621789b3
+# Parent  bdc6dd89d83c2fcd87b069557b6f8867ab95dda1
+libxc: [CVE-2011-1583] pv kernel image validation
+
+The functions which interpret the kernel image supplied for a
+paravirtualised guest, and decompress it into memory when booting the
+domain, are incautious.  Specifically:
+
+ (i) Integer overflow in the decompression loop memory allocator might
+    result in overrunning the buffer used for the decompressed image;
+ (ii) Integer overflows and lack of checking of certain length fields
+    can result in the loader reading its own address space beyond the
+    size of the supplied kernel image file.
+ (iii) Lack of error checking in the decompression loop can lead to an
+    infinite loop.
+
+This patch fixes these problems.
+
+CVE-2011-1583.
+
+Signed-off-by: Ian Campbell <Ian.Campbell@eu.citrix.com>
+Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
+Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
+
+diff -r bdc6dd89d83c -r e2e575f8b5d9 libxc/xc_dom_bzimageloader.c
+--- libxc/xc_dom_bzimageloader.c	Mon May 09 12:18:50 2011 +0100
++++ libxc/xc_dom_bzimageloader.c	Mon May 09 15:04:01 2011 +0100
+@@ -82,8 +82,29 @@
+     for ( ; ; )
+     {
+         ret = BZ2_bzDecompress(&stream);
+-        if ( (stream.avail_out == 0) || (ret != BZ_OK) )
++        if ( ret == BZ_STREAM_END )
+         {
++            DOMPRINTF("BZIP2: Saw data stream end");
++            retval = 0;
++            break;
++        }
++        if ( ret != BZ_OK )
++        {
++            DOMPRINTF("BZIP2: error %d", ret);
++            free(out_buf);
++            goto bzip2_cleanup;
++        }
++
++        if ( stream.avail_out == 0 )
++        {
++            /* Protect against output buffer overflow */
++            if ( outsize > INT_MAX / 2 )
++            {
++                DOMPRINTF("BZIP2: output buffer overflow");
++                free(out_buf);
++                goto bzip2_cleanup;
++            }
++
+             tmp_buf = realloc(out_buf, outsize * 2);
+             if ( tmp_buf == NULL )
+             {
+@@ -97,16 +118,18 @@
+             stream.avail_out = (outsize * 2) - outsize;
+             outsize *= 2;
+         }
+-
+-        if ( ret != BZ_OK )
++        else if ( stream.avail_in == 0 )
+         {
+-            if ( ret == BZ_STREAM_END )
+-            {
+-                DOMPRINTF("BZIP2: Saw data stream end");
+-                retval = 0;
+-                break;
+-            }
+-            DOMPRINTF("BZIP2: error");
++            /*
++             * If there is output buffer available then this indicates
++             * that BZ2_bzDecompress would like more input data to be
++             * provided.  However our complete input buffer is in
++             * memory and provided upfront so if avail_in is zero this
++             * actually indicates a truncated input.
++             */
++            DOMPRINTF("BZIP2: not enough input");
++            free(out_buf);
++            goto bzip2_cleanup;
+         }
+     }
+ 
+@@ -180,31 +203,14 @@
+     for ( ; ; )
+     {
+         ret = lzma_code(&stream, action);
+-        if ( (stream.avail_out == 0) || (ret != LZMA_OK) )
++        if ( ret == LZMA_STREAM_END )
+         {
+-            tmp_buf = realloc(out_buf, outsize * 2);
+-            if ( tmp_buf == NULL )
+-            {
+-                DOMPRINTF("LZMA: Failed to realloc memory");
+-                free(out_buf);
+-                goto lzma_cleanup;
+-            }
+-            out_buf = tmp_buf;
+-
+-            stream.next_out = out_buf + outsize;
+-            stream.avail_out = (outsize * 2) - outsize;
+-            outsize *= 2;
++            DOMPRINTF("LZMA: Saw data stream end");
++            retval = 0;
++            break;
+         }
+-
+         if ( ret != LZMA_OK )
+         {
+-            if ( ret == LZMA_STREAM_END )
+-            {
+-                DOMPRINTF("LZMA: Saw data stream end");
+-                retval = 0;
+-                break;
+-            }
+-
+             switch ( ret )
+             {
+             case LZMA_MEM_ERROR:
+@@ -238,7 +244,32 @@
+             }
+             DOMPRINTF("%s: LZMA decompression error %s",
+                       __FUNCTION__, msg);
+-            break;
++            free(out_buf);
++            goto lzma_cleanup;
++        }
++
++        if ( stream.avail_out == 0 )
++        {
++            /* Protect against output buffer overflow */
++            if ( outsize > INT_MAX / 2 )
++            {
++                DOMPRINTF("LZMA: output buffer overflow");
++                free(out_buf);
++                goto lzma_cleanup;
++            }
++
++            tmp_buf = realloc(out_buf, outsize * 2);
++            if ( tmp_buf == NULL )
++            {
++                DOMPRINTF("LZMA: Failed to realloc memory");
++                free(out_buf);
++                goto lzma_cleanup;
++            }
++            out_buf = tmp_buf;
++
++            stream.next_out = out_buf + outsize;
++            stream.avail_out = (outsize * 2) - outsize;
++            outsize *= 2;
+         }
+     }
+ 
+@@ -489,18 +520,18 @@
+ 
+ extern struct xc_dom_loader elf_loader;
+ 
+-static unsigned int payload_offset(struct setup_header *hdr)
++static int check_magic(struct xc_dom_image *dom, const void *magic, size_t len)
+ {
+-    unsigned int off;
++    if (len > dom->kernel_size)
++        return 0;
+ 
+-    off = (hdr->setup_sects + 1) * 512;
+-    off += hdr->payload_offset;
+-    return off;
++    return (memcmp(dom->kernel_blob, magic, len) == 0);
+ }
+ 
+ static int xc_dom_probe_bzimage_kernel(struct xc_dom_image *dom)
+ {
+     struct setup_header *hdr;
++    uint64_t payload_offset, payload_length;
+     int ret;
+ 
+     if ( dom->kernel_blob == NULL )
+@@ -533,10 +564,30 @@
+         return -EINVAL;
+     }
+ 
+-    dom->kernel_blob = dom->kernel_blob + payload_offset(hdr);
+-    dom->kernel_size = hdr->payload_length;
+ 
+-    if ( memcmp(dom->kernel_blob, "\037\213", 2) == 0 )
++    /* upcast to 64 bits to avoid overflow */
++    /* setup_sects is u8 and so cannot overflow */
++    payload_offset = (hdr->setup_sects + 1) * 512;
++    payload_offset += hdr->payload_offset;
++    payload_length = hdr->payload_length;
++
++    if ( payload_offset >= dom->kernel_size )
++    {
++        xc_dom_panic(dom->xch, XC_INVALID_KERNEL, "%s: payload offset overflow",
++                     __FUNCTION__);
++        return -EINVAL;
++    }
++    if ( (payload_offset + payload_length) > dom->kernel_size )
++    {
++        xc_dom_panic(dom->xch, XC_INVALID_KERNEL, "%s: payload length overflow",
++                     __FUNCTION__);
++        return -EINVAL;
++    }
++
++    dom->kernel_blob = dom->kernel_blob + payload_offset;
++    dom->kernel_size = payload_length;
++
++    if ( check_magic(dom, "\037\213", 2) )
+     {
+         ret = xc_dom_try_gunzip(dom, &dom->kernel_blob, &dom->kernel_size);
+         if ( ret == -1 )
+@@ -546,7 +597,7 @@
+             return -EINVAL;
+         }
+     }
+-    else if ( memcmp(dom->kernel_blob, "\102\132\150", 3) == 0 )
++    else if ( check_magic(dom, "\102\132\150", 3) )
+     {
+         ret = xc_try_bzip2_decode(dom, &dom->kernel_blob, &dom->kernel_size);
+         if ( ret < 0 )
+@@ -557,7 +608,7 @@
+             return -EINVAL;
+         }
+     }
+-    else if ( memcmp(dom->kernel_blob, "\135\000", 2) == 0 )
++    else if ( check_magic(dom, "\135\000", 2) )
+     {
+         ret = xc_try_lzma_decode(dom, &dom->kernel_blob, &dom->kernel_size);
+         if ( ret < 0 )
+@@ -568,7 +619,7 @@
+             return -EINVAL;
+         }
+     }
+-    else if ( memcmp(dom->kernel_blob, "\x89LZO", 5) == 0 )
++    else if ( check_magic(dom, "\x89LZO", 5) )
+     {
+         ret = xc_try_lzo1x_decode(dom, &dom->kernel_blob, &dom->kernel_size);
+         if ( ret < 0 )
+