!1197 整数溢出漏洞修复

Merge pull request !1197 from hw_llm/master
Description: fix CVE-817641412102197248
2024-07-15 13:45:01 +00:00 · 2024-07-12 15:03:23 +08:00 · 2024-07-11 13:32:59 +00:00 · 2024-07-11 16:50:49 +08:00 · 2024-05-27 11:37:41 +00:00 · 2024-05-25 02:30:55 +00:00
3 changed files with 17 additions and 7 deletions
--- a/OAT.xml
+++ b/OAT.xml
@@ -65,6 +65,8 @@
                <!--filteritem type="filepath" name="projectroot/[a-zA-Z0-9]{20,}.sh" desc="Temp files"/-->
            </filefilter>
            <filefilter name="binaryFileTypePolicyFilter" desc="Filters for binary file policies">
+                <filteritem type="filepath" name="figures/architecture-of-the-openharmony-liteos-cortex-a-kernel.png" desc="architecture-of-the-openharmony-liteos-cortex-a-kernel"/>
+                <filteritem type="filepath" name="figures/OpenHarmony-LiteOS-A内核架构图.png" desc="LiteOS-A内核架构图"/>
                <!--filteritem type="filename" name="*.uvwxyz" desc="Describe the reason for filtering scan results"/-->
                <!--filteritem type="filepath" name="abcdefg/.*.uvwxyz" desc="Describe the reason for filtering scan results"/-->
                <!--filteritem type="filepath" name="projectroot/[a-zA-Z0-9]{20,}.sh" desc="Temp files"/-->
--- a/compat/posix/src/mqueue.c
+++ b/compat/posix/src/mqueue.c
@@ -270,6 +270,7 @@ STATIC INT32 DoMqueueClose(struct mqpersonal *privateMqPersonal)
 {
    struct mqarray *mqueueCB = NULL;
    struct mqpersonal *tmp = NULL;
+    INT32 ret;

    mqueueCB = privateMqPersonal->mq_posixdes;
    if (mqueueCB == NULL || mqueueCB->mq_personal == NULL) {
@@ -277,6 +278,12 @@ STATIC INT32 DoMqueueClose(struct mqpersonal *privateMqPersonal)
        return LOS_NOK;
    }

+    if ((mqueueCB->unlinkflag == TRUE) && (privateMqPersonal->mq_next == NULL)) {
+        ret = DoMqueueDelete(mqueueCB);
+        if (ret < 0) {
+            return ret;
+        }
+    }
    /* find the personal and remove */
    if (mqueueCB->mq_personal == privateMqPersonal) {
        mqueueCB->mq_personal = privateMqPersonal->mq_next;
@@ -298,9 +305,6 @@ STATIC INT32 DoMqueueClose(struct mqpersonal *privateMqPersonal)
    /* free the personal */
    (VOID)LOS_MemFree(OS_SYS_MEM_ADDR, privateMqPersonal);

-    if ((mqueueCB->unlinkflag == TRUE) && (mqueueCB->mq_personal == NULL)) {
-        return DoMqueueDelete(mqueueCB);
-    }
    return LOS_OK;
 }

@@ -604,17 +608,19 @@ int OsMqGetAttr(mqd_t personal, struct mq_attr *mqAttr)
    struct mqarray *mqueueCB = NULL;
    struct mqpersonal *privateMqPersonal = NULL;

+    (VOID)pthread_mutex_lock(&IPC_QUEUE_MUTEX);
    privateMqPersonal = MqGetPrivDataBuff(personal);
    if (privateMqPersonal == NULL) {
+        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
        return -1;
    }

    if (mqAttr == NULL) {
        errno = EINVAL;
+        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
        return -1;
    }

-    (VOID)pthread_mutex_lock(&IPC_QUEUE_MUTEX);
    if (privateMqPersonal->mq_status != MQ_USE_MAGIC) {
        errno = EBADF;
        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
@@ -634,17 +640,19 @@ int OsMqSetAttr(mqd_t personal, const struct mq_attr *mqSetAttr, struct mq_attr
 {
    struct mqpersonal *privateMqPersonal = NULL;

+    (VOID)pthread_mutex_lock(&IPC_QUEUE_MUTEX);
    privateMqPersonal = MqGetPrivDataBuff(personal);
    if (privateMqPersonal == NULL) {
+        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
        return -1;
    }

    if (mqSetAttr == NULL) {
        errno = EINVAL;
+        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
        return -1;
    }

-    (VOID)pthread_mutex_lock(&IPC_QUEUE_MUTEX);
    if (privateMqPersonal->mq_status != MQ_USE_MAGIC) {
        errno = EBADF;
        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
--- a/syscall/net_syscall.c
+++ b/syscall/net_syscall.c
@@ -401,7 +401,7 @@ ssize_t SysSendMsg(int s, const struct msghdr *message, int flags)
    CHECK_ASPACE(message, sizeof(struct msghdr));
    CPY_FROM_CONST_USER(struct msghdr, message);

-    if (message && message->msg_iovlen > IOV_MAX) {
+    if (message && (size_t)message->msg_iovlen > IOV_MAX) {
        set_errno(EMSGSIZE);
        return -get_errno();
    }
@@ -449,7 +449,7 @@ ssize_t SysRecvMsg(int s, struct msghdr *message, int flags)
    CHECK_ASPACE(message, sizeof(struct msghdr));
    CPY_FROM_NONCONST_USER(message);

-    if (message && message->msg_iovlen > IOV_MAX) {
+    if (message && (size_t)message->msg_iovlen > IOV_MAX) {
        set_errno(EMSGSIZE);
        return -get_errno();
    }
Author	SHA1	Message	Date
openharmony_ci	cc34b8f00e	!1197 整数溢出漏洞修复 Merge pull request !1197 from hw_llm/master	2024-07-15 13:45:01 +00:00
hw_llm	da45d3f539	Description: fix CVE-817641412102197248 IssueNo: https://gitee.com/openharmony/kernel_liteos_a/issues/IACJLK Feature Or Bugfix: Bugfix Binary Source: No Signed-off-by: hw_llm <liu.limin@huawei.com>	2024-07-12 15:03:23 +08:00
openharmony_ci	49ad79f55e	!1194 解决UAF问题 Merge pull request !1194 from hw_llm/master	2024-07-11 13:32:59 +00:00
hw_llm	78db02de2c	Description: fix CVE-810023952561737728 IssueNo: https://gitee.com/openharmony/kernel_liteos_a/issues/IAAZWU Feature Or Bugfix: Bugfix Binary Source: No Signed-off-by: hw_llm <liu.limin@huawei.com>	2024-07-11 16:50:49 +08:00
openharmony_ci	7fcec6797c	!1192 【修复】OAT告警 Merge pull request !1192 from 石子怡/master	2024-05-27 11:37:41 +00:00
石子怡	dff8682d4d	修复OAT告警 Signed-off-by: 石子怡 <z15319797139@163.com>	2024-05-25 02:30:55 +00:00
石子怡	b0520a56f4	修复OAT告警 Signed-off-by: 石子怡 <z15319797139@163.com>	2024-05-25 01:33:58 +00:00
openharmony_ci	180bf8e5cd	!1189 内核mqueue 竞争漏洞修复 Merge pull request !1189 from hw_llm/master	2024-05-11 03:01:05 +00:00
hw_llm	dbbb96c427	Description: liteos_a 内核竞争漏洞修复 IssueNo: https://gitee.com/openharmony/kernel_liteos_a/issues/I9OACM Feature Or Bugfix: Bugfix Binary Source: No Signed-off-by: hw_llm <liu.limin@huawei.com>	2024-05-10 20:05:39 +08:00