From d25e5e3879f1a1c1cf6a5bcd82f6cc2eb7288c72 Mon Sep 17 00:00:00 2001 From: Reid Rankin Date: Thu, 23 Jan 2020 17:07:21 +0000 Subject: Harden signature verification process This mostly boils down to making sure control_started and data_started are consistently used to gate actions, instead of relying whether on file names start with a '.'. None of the weaknesses this fixes are exploitable, but they might have become so after changes to seemingly-unrelated code, so it's good to clean them up. --- src/package.c | 33 +++++++++++++++++++-------------- 1 file changed, 19 insertions(+), 14 deletions(-) (limited to 'src/package.c') diff --git a/src/package.c b/src/package.c index 01ae3aa..6cfb8d4 100644 --- a/src/package.c +++ b/src/package.c @@ -613,14 +613,16 @@ int apk_sign_ctx_parse_pkginfo_line(void *ctx, apk_blob_t line) struct apk_sign_ctx *sctx = (struct apk_sign_ctx *) ctx; apk_blob_t l, r; + if (!sctx->control_started || sctx->data_started) + return 0; + if (line.ptr == NULL || line.len < 1 || line.ptr[0] == '#') return 0; if (!apk_blob_split(line, APK_BLOB_STR(" = "), &l, &r)) return 0; - if (sctx->data_started == 0 && - apk_blob_compare(APK_BLOB_STR("datahash"), l) == 0) { + if (apk_blob_compare(APK_BLOB_STR("datahash"), l) == 0) { sctx->has_data_checksum = 1; sctx->md = EVP_sha256(); apk_blob_pull_hexdump( @@ -641,6 +643,9 @@ int apk_sign_ctx_verify_tar(void *sctx, const struct apk_file_info *fi, if (r <= 0) return r; + if (!ctx->control_started || ctx->data_started) + return 0; + if (strcmp(fi->name, ".PKGINFO") == 0) { apk_blob_t l, token = APK_BLOB_STR("\n"); while (!APK_BLOB_IS_NULL(l = apk_istream_get_delim(is, token))) @@ -891,21 +896,21 @@ static int read_info_entry(void *ctx, const struct apk_file_info *ae, struct apk_package *pkg = ri->pkg; int r; - /* Meta info and scripts */ r = apk_sign_ctx_process_file(ri->sctx, ae, is); - if (r <= 0) return r; + if (r <= 0) + return r; - if (ae->name[0] == '.') { - /* APK 2.0 format */ - if (strcmp(ae->name, ".PKGINFO") == 0) { - apk_blob_t l, token = APK_BLOB_STR("\n"); - while (!APK_BLOB_IS_NULL(l = apk_istream_get_delim(is, token))) - read_info_line(ctx, l); - } else if (strcmp(ae->name, ".INSTALL") == 0) { - apk_warning("Package '%s-%s' contains deprecated .INSTALL", - pkg->name->name, pkg->version); - } + if (!ri->sctx->control_started || ri->sctx->data_started) return 0; + + if (strcmp(ae->name, ".PKGINFO") == 0) { + /* APK 2.0 format */ + apk_blob_t l, token = APK_BLOB_STR("\n"); + while (!APK_BLOB_IS_NULL(l = apk_istream_get_delim(is, token))) + read_info_line(ctx, l); + } else if (strcmp(ae->name, ".INSTALL") == 0) { + apk_warning("Package '%s-%s' contains deprecated .INSTALL", + pkg->name->name, pkg->version); } return 0; -- cgit v1.2.3-60-g2f50