Merge lp:~choffee/ubuntu/lucid/xml-security-c/xml-security-c-fix-807414 into lp:ubuntu/lucid/xml-security-c

[John Cooper]

Fixes Buffer overflow bugs CVE-2011-2516 as detailed in LP: #807414

This is just a pull across of the the Debian fix.

[Marc Deslauriers (mdeslaur)]

Thanks for the merge request.

Please just include the security fix, and none of the other packaging changes and changelogs.
See the following wiki page for the process on submitting changes appropriate for Ubuntu security fixes:

https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation

Thanks!

review: Needs Fixing

Unmerged revisions

9. By John Cooper <email address hidden> on 2011-07-25

Apply upstream patch to fix buffer overflow when signing or verifying
files with big asymmetric keys. (Closes: #632973, CVE-2011-2516)

8. By John Cooper <email address hidden> on 2011-07-25

* Force source format 1.0 for now since it makes backporting easier.
* Add ${misc:Depends} to all package dependencies.
* Update debhelper compatibility level to V7.
  - Use dh_prep instead of dh_clean -k.
* Update standards version to 3.8.4 (no changes required).

=== modified file 'debian/changelog'
--- debian/changelog	2010-03-22 21:58:17 +0000
+++ debian/changelog	2011-07-25 11:10:26 +0000
@@ -1,8 +1,19 @@
-xml-security-c (1.5.1-2build1) lucid; urgency=low
-
-  * No-change rebuild for libxerces-c3.0 -> libxerces-c3.1 transition.
-
- -- Ilya Barygin <[e-mail]>  Mon, 22 Mar 2010 21:58:17 +0300
+xml-security-c (1.5.1-3+squeeze1) stable-security; urgency=high
+
+  * Apply upstream patch to fix buffer overflow when signing or verifying
+    files with big asymmetric keys.  (Closes: #632973, CVE-2011-2516)
+
+ -- Russ Allbery <[e-mail]>  Thu, 07 Jul 2011 10:45:08 -0700
+
+xml-security-c (1.5.1-3) unstable; urgency=low
+
+  * Force source format 1.0 for now since it makes backporting easier.
+  * Add ${misc:Depends} to all package dependencies.
+  * Update debhelper compatibility level to V7.
+    - Use dh_prep instead of dh_clean -k.
+  * Update standards version to 3.8.4 (no changes required).
+
+ -- Russ Allbery <[e-mail]>  Wed, 12 May 2010 20:59:25 -0700
 
 xml-security-c (1.5.1-2) unstable; urgency=low
 

=== modified file 'debian/compat'
--- debian/compat	2007-04-12 21:37:45 +0000
+++ debian/compat	2011-07-25 11:10:26 +0000
@@ -1,1 +1,1 @@
-5
+7

=== modified file 'debian/control'
--- debian/control	2009-08-06 08:32:16 +0000
+++ debian/control	2011-07-25 11:10:26 +0000
@@ -3,9 +3,9 @@
 Priority: extra
 Maintainer: Debian Shib Team <[e-mail]>
 Uploaders: Russ Allbery <[e-mail]>
-Build-Depends: debhelper (>= 5), autoconf, automake, libtool, libssl-dev,
+Build-Depends: debhelper (>= 7), autoconf, automake, libtool, libssl-dev,
  libxerces-c-dev
-Standards-Version: 3.8.2
+Standards-Version: 3.8.4
 Homepage: http://xml.apache.org/security/
 Vcs-Git: git://git.debian.org/git/pkg-shibboleth/xml-security-c.git
 Vcs-Browser: http://git.debian.org/?p=pkg-shibboleth/xml-security-c.git
@@ -14,9 +14,9 @@
 Architecture: any
 Depends: ${shlibs:Depends}, ${misc:Depends}
 Description: C++ library for XML Digital Signatures (runtime)
- XML-Security-C is a library for the XML Digital Security specification.  It
- provides processing and handling of XML Key Management Specifications (XKMS)
- messages.
+ XML-Security-C is a library for the XML Digital Security specification.
+ It provides processing and handling of XML Key Management Specifications
+ (XKMS) messages.
  .
  This package contains the files necessary for running applications that
  use the XML-Security-C library.
@@ -24,11 +24,11 @@
 Package: libxml-security-c-dev
 Section: libdevel
 Architecture: any
-Depends: libxml-security-c15 (= ${binary:Version}), libxerces-c-dev,
- libssl-dev
+Depends: ${misc:Depends}, libxml-security-c15 (= ${binary:Version}),
+ libxerces-c-dev, libssl-dev
 Description: C++ library for XML Digital Signatures (development)
- XML-Security-C is a library for the XML Digital Security specification.  It
- provides processing and handling of XML Key Management Specifications (XKMS)
- messages.
+ XML-Security-C is a library for the XML Digital Security specification.
+ It provides processing and handling of XML Key Management Specifications
+ (XKMS) messages.
  .
  This package contains the XML-Security-C development files.

=== modified file 'debian/rules'
--- debian/rules	2009-08-05 14:11:52 +0000
+++ debian/rules	2011-07-25 11:10:26 +0000
@@ -62,7 +62,7 @@
 install: build-stamp
 	dh_testdir
 	dh_testroot
-	dh_clean -k
+	dh_prep
 	$(MAKE) install DESTDIR=$(CURDIR)/debian/tmp
 	dh_install --sourcedir=debian/tmp
 

=== added directory 'debian/source'
=== added file 'debian/source/format'
--- debian/source/format	1970-01-01 00:00:00 +0000
+++ debian/source/format	2011-07-25 11:10:26 +0000
@@ -0,0 +1,1 @@
+1.0

=== modified file 'src/dsig/DSIGAlgorithmHandlerDefault.cpp'
--- src/dsig/DSIGAlgorithmHandlerDefault.cpp	2009-08-05 14:11:52 +0000
+++ src/dsig/DSIGAlgorithmHandlerDefault.cpp	2011-07-25 11:10:26 +0000
@@ -42,6 +42,7 @@
 
 XERCES_CPP_NAMESPACE_USE
 
+#define MAXB64BUFSIZE 2048
 
 // --------------------------------------------------------------------------------
 //           Some useful utility functions
@@ -53,10 +54,10 @@
 							  unsigned int rawLen, 
 							  unsigned int maxCompare = 0) {
 	// Decode a base64 buffer and then compare the result to a raw buffer
-	// Compare at most maxCompare bits (if maxComare > 0)
+	// Compare at most maxCompare bits (if maxCompare > 0)
 	// Note - whilst the other parameters are bytes, maxCompare is bits
 
-	unsigned char outputStr[1024];
+	unsigned char outputStr[MAXB64BUFSIZE];
 	unsigned int outputLen = 0;
 	
 	XSECCryptoBase64 * b64 = XSECPlatformUtils::g_cryptoProvider->base64();
@@ -71,8 +72,8 @@
 	Janitor<XSECCryptoBase64> j_b64(b64);
 
 	b64->decodeInit();
-	outputLen = b64->decode((unsigned char *) b64Str, (unsigned int) strlen((char *) b64Str), outputStr, 1024);
-	outputLen += b64->decodeFinish(&outputStr[outputLen], 1024 - outputLen);
+	outputLen = b64->decode((unsigned char *) b64Str, (unsigned int) strlen((char *) b64Str), outputStr, MAXB64BUFSIZE);
+	outputLen += b64->decodeFinish(&outputStr[outputLen], MAXB64BUFSIZE - outputLen);
 
 	// Compare
 
@@ -144,7 +145,7 @@
 	// Translate the rawbuffer (at most maxBits or rawLen - whichever is smaller)
 	// to a base64 string
 
-	unsigned char b64Str[1024];
+	unsigned char b64Str[MAXB64BUFSIZE];
 	unsigned int outputLen = 0;
 	
 	XSECCryptoBase64 * b64 = XSECPlatformUtils::g_cryptoProvider->base64();
@@ -175,8 +176,8 @@
 		size = rawLen;
 
 	b64->encodeInit();
-	outputLen = b64->encode((unsigned char *) raw, rawLen, b64Str, 1024);
-	outputLen += b64->encodeFinish(&b64Str[outputLen], 1024 - outputLen);
+	outputLen = b64->encode((unsigned char *) raw, rawLen, b64Str, MAXB64BUFSIZE - 1);
+	outputLen += b64->encodeFinish(&b64Str[outputLen], MAXB64BUFSIZE - outputLen - 1);
 	b64Str[outputLen] = '\0';
 
 	// Copy out
@@ -380,7 +381,10 @@
 	
 	// Now check the calculated hash
 
-	char b64Buf[1024];
+	// For now, use a fixed length buffer, but expand it,
+	// and detect if the signature size exceeds what we can
+	// handle.
+	char b64Buf[MAXB64BUFSIZE];
 	unsigned int b64Len;
 	safeBuffer b64SB;
 	
@@ -400,7 +404,7 @@
 			hash, 
 			hashLen,
 			(char *) b64Buf, 
-			1024);
+			MAXB64BUFSIZE);
 
 		if (b64Len <= 0) {
 
@@ -408,6 +412,12 @@
 				"Unknown error occured during a DSA Signing operation");
 
 		}
+		else if (b64Len >= MAXB64BUFSIZE) {
+
+            throw XSECException(XSECException::AlgorithmMapperError,
+                "DSA Signing operation exceeded size of buffer");
+
+		}
 
 		if (b64Buf[b64Len-1] == '\n')
 			b64Buf[b64Len-1] = '\0';
@@ -430,7 +440,7 @@
 			hash, 
 			hashLen,
 			(char *) b64Buf, 
-			1024,
+			MAXB64BUFSIZE,
 			hm);
 
 		if (b64Len <= 0) {
@@ -439,6 +449,12 @@
 				"Unknown error occured during a RSA Signing operation");
 
 		}
+        else if (b64Len >= MAXB64BUFSIZE) {
+
+            throw XSECException(XSECException::AlgorithmMapperError,
+                "RSA Signing operation exceeded size of buffer");
+
+        }
 
 		// Clean up some "funnies" and make sure the string is NULL terminated
 
@@ -471,7 +487,7 @@
 								hashLen, 
 								outputLength);
 		
-		strncpy(b64Buf, (char *) b64SB.rawBuffer(), 1024);
+		strncpy(b64Buf, (char *) b64SB.rawBuffer(), MAXB64BUFSIZE);
 		break;
 
 	default :

=== modified file 'src/enc/OpenSSL/OpenSSLCryptoKeyDSA.cpp'
--- src/enc/OpenSSL/OpenSSLCryptoKeyDSA.cpp	2009-08-05 14:11:52 +0000
+++ src/enc/OpenSSL/OpenSSLCryptoKeyDSA.cpp	2011-07-25 11:10:26 +0000
@@ -33,6 +33,10 @@
 #include <xsec/enc/XSECCryptoUtils.hpp>
 #include <xsec/framework/XSECError.hpp>
 
+#include <xercesc/util/Janitor.hpp>
+
+XERCES_CPP_NAMESPACE_USE
+
 #include <openssl/dsa.h>
 
 OpenSSLCryptoKeyDSA::OpenSSLCryptoKeyDSA() : mp_dsaKey(NULL) {
@@ -157,12 +161,13 @@
 			"OpenSSL:DSA - Attempt to validate signature with empty key");
 	}
 
-	unsigned char sigVal[512];
 	int sigValLen;
 	int err;
 
 	EVP_ENCODE_CTX m_dctx;
 	int rc;
+        unsigned char* sigVal = new unsigned char[sigLen + 1];
+    ArrayJanitor<unsigned char> j_sigVal(sigVal);
 
 	EVP_DecodeInit(&m_dctx);
 	rc = EVP_DecodeUpdate(&m_dctx,
@@ -271,10 +276,10 @@
 
 	// Now turn the signature into a base64 string
 
-	unsigned char rawSigBuf[256];
-	unsigned int rawLen;
-
-	rawLen = BN_bn2bin(dsa_sig->r, rawSigBuf);
+	unsigned char* rawSigBuf = new unsigned char[(BN_num_bits(dsa_sig->r) + BN_num_bits(dsa_sig->s)) / 8];
+    ArrayJanitor<unsigned char> j_sigbuf(rawSigBuf);
+	
+    unsigned int rawLen = BN_bn2bin(dsa_sig->r, rawSigBuf);
 
 	if (rawLen <= 0) {
 

=== modified file 'src/enc/OpenSSL/OpenSSLCryptoKeyRSA.cpp'
--- src/enc/OpenSSL/OpenSSLCryptoKeyRSA.cpp	2009-08-05 14:11:52 +0000
+++ src/enc/OpenSSL/OpenSSLCryptoKeyRSA.cpp	2011-07-25 11:10:26 +0000
@@ -186,21 +186,20 @@
 			"OpenSSL:RSA - Attempt to validate signature with empty key");
 	}
 
-	unsigned char sigVal[1024];
-	int sigValLen;
-
-	EVP_ENCODE_CTX m_dctx;
-	int rc;
-
-	char * cleanedBase64Signature;
+	char* cleanedBase64Signature;
 	unsigned int cleanedBase64SignatureLen = 0;
 
 	cleanedBase64Signature =
 		XSECCryptoBase64::cleanBuffer(base64Signature, sigLen, cleanedBase64SignatureLen);
 	ArrayJanitor<char> j_cleanedBase64Signature(cleanedBase64Signature);
 
+	int sigValLen;
+	unsigned char* sigVal = new unsigned char[sigLen + 1];
+    ArrayJanitor<unsigned char> j_sigVal(sigVal);
+
+    EVP_ENCODE_CTX m_dctx;
 	EVP_DecodeInit(&m_dctx);
-	rc = EVP_DecodeUpdate(&m_dctx,
+	int rc = EVP_DecodeUpdate(&m_dctx,
 						  sigVal,
 						  &sigValLen,
 						  (unsigned char *) cleanedBase64Signature,