Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2022-24795 #239

Open
anticomputer opened this issue Apr 6, 2022 · 4 comments
Open

CVE-2022-24795 #239

anticomputer opened this issue Apr 6, 2022 · 4 comments

Comments

@anticomputer
Copy link

Hello, I am a member of the GitHub Security team and am seeking a maintainer contact for this project with regards to GHSA-jj47-x69x-mxrm

We were unable to establish contact with a maintainer for this project during the coordinated disclosure process for CVE-2022-24795. If this project is still actively maintained, we'd like to offer our assistance in getting this issue resolved in your library. If it is no longer actively maintained, we recommend archiving this repository.
@robohack
Copy link

robohack commented Apr 6, 2022

I'm actively maintaining a derived version at https://github.com/robohack/yajl/ (on the default branch "bsdmake").

I'm not sure what this could mean for lloyd/yajl, except to say that I would not be opposed to archiving it.

(as lloyd/yajl, and thus so far my own variant, do not directly do their own memory allocation error checking, I think the simple quick hack is to add a basic assert(), and a safer fix would be a direct call to abort(); though also allowing greater than 2^31 byte buffers on 32-bit platforms through use of a non-exponential size increment might be appropriate)

@anticomputer
Copy link
Author

👋 @robohack you can find our patches for the 1.x branch included with yajl-ruby here

@robohack
Copy link

robohack commented Apr 6, 2022

Actually I take that suggestion for calling abort() back. (The assert() is still useful of course, but can't be expected to be enabled in all circumstances.)

The best general solution is to recommend that a user-supplied realloc call do whatever error handling it would do for a realloc() failure whenever an allocation of zero bytes is requested.

ppisar added a commit to ppisar/yajl that referenced this issue Apr 7, 2022
@ppisar
Fix CVE-2022-24795
23cea2d 
There was an integer overflow in yajl_buf_ensure_available() leading
to allocating less memory than requested. Then data were written past
the allocated heap buffer in yajl_buf_append(), the only caller of
yajl_buf_ensure_available(). Another result of the overflow was an
infinite loop without a return from yajl_buf_ensure_available().

yajl-ruby project, which bundles yajl, fixed it
<brianmario/yajl-ruby#211> by checking for the
integer overflow, fortifying buffer allocations, and report the
failures to a caller. But then the caller yajl_buf_append() skips
a memory write if yajl_buf_ensure_available() failed leading to a data
corruption.

A yajl fork mainter recommended calling memory allocation callbacks with
the large memory request and let them to handle it. But that has the
problem that it's not possible pass the overely large size to the
callbacks.

This patch catches the integer overflow and terminates the process
with abort().

lloyd#239
GHSA-jj47-x69x-mxrm
@ppisar ppisar mentioned this issue Apr 7, 2022
Open
@QuLogic QuLogic mentioned this issue Apr 9, 2022
Open
@ayin1551 ayin1551 mentioned this issue Jun 6, 2022
Open
berrange pushed a commit to berrange/yajl that referenced this issue Jul 10, 2023
@ppisar @berrange
Fix CVE-2022-24795
32f1b51 
There was an integer overflow in yajl_buf_ensure_available() leading
to allocating less memory than requested. Then data were written past
the allocated heap buffer in yajl_buf_append(), the only caller of
yajl_buf_ensure_available(). Another result of the overflow was an
infinite loop without a return from yajl_buf_ensure_available().

yajl-ruby project, which bundles yajl, fixed it
<brianmario/yajl-ruby#211> by checking for the
integer overflow, fortifying buffer allocations, and report the
failures to a caller. But then the caller yajl_buf_append() skips
a memory write if yajl_buf_ensure_available() failed leading to a data
corruption.

A yajl fork mainter recommended calling memory allocation callbacks with
the large memory request and let them to handle it. But that has the
problem that it's not possible pass the overely large size to the
callbacks.

This patch catches the integer overflow and terminates the process
with abort().

lloyd#239
GHSA-jj47-x69x-mxrm
(cherry picked from commit 23cea2d
 in https://github.com/ppisar/yajl)
berrange pushed a commit to berrange/yajl that referenced this issue Jul 10, 2023
@ppisar @berrange
Fix CVE-2022-24795
17de4d1 
There was an integer overflow in yajl_buf_ensure_available() leading
to allocating less memory than requested. Then data were written past
the allocated heap buffer in yajl_buf_append(), the only caller of
yajl_buf_ensure_available(). Another result of the overflow was an
infinite loop without a return from yajl_buf_ensure_available().

yajl-ruby project, which bundles yajl, fixed it
<brianmario/yajl-ruby#211> by checking for the
integer overflow, fortifying buffer allocations, and report the
failures to a caller. But then the caller yajl_buf_append() skips
a memory write if yajl_buf_ensure_available() failed leading to a data
corruption.

A yajl fork mainter recommended calling memory allocation callbacks with
the large memory request and let them to handle it. But that has the
problem that it's not possible pass the overely large size to the
callbacks.

This patch catches the integer overflow and terminates the process
with abort().

lloyd#239
GHSA-jj47-x69x-mxrm
(cherry picked from commit 23cea2d
 in https://github.com/ppisar/yajl)
reinerh pushed a commit to reinerh/cdogs-sdl that referenced this issue Sep 16, 2023
@ppisar @reinerh
Fix CVE-2022-24795
8805ab2 
There was an integer overflow in yajl_buf_ensure_available() leading
to allocating less memory than requested. Then data were written past
the allocated heap buffer in yajl_buf_append(), the only caller of
yajl_buf_ensure_available(). Another result of the overflow was an
infinite loop without a return from yajl_buf_ensure_available().

yajl-ruby project, which bundles yajl, fixed it
<brianmario/yajl-ruby#211> by checking for the
integer overflow, fortifying buffer allocations, and report the
failures to a caller. But then the caller yajl_buf_append() skips
a memory write if yajl_buf_ensure_available() failed leading to a data
corruption.

A yajl fork mainter recommended calling memory allocation callbacks with
the large memory request and let them to handle it. But that has the
problem that it's not possible pass the overely large size to the
callbacks.

This patch catches the integer overflow and terminates the process
with abort().

GHSA-jj47-x69x-mxrm

Origin: ppisar/yajl@23cea2d
Bug: lloyd/yajl#239
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040036
cxong pushed a commit to cxong/cdogs-sdl that referenced this issue Sep 18, 2023
@ppisar @cxong
Fix CVE-2022-24795
d78dc96 
There was an integer overflow in yajl_buf_ensure_available() leading
to allocating less memory than requested. Then data were written past
the allocated heap buffer in yajl_buf_append(), the only caller of
yajl_buf_ensure_available(). Another result of the overflow was an
infinite loop without a return from yajl_buf_ensure_available().

yajl-ruby project, which bundles yajl, fixed it
<brianmario/yajl-ruby#211> by checking for the
integer overflow, fortifying buffer allocations, and report the
failures to a caller. But then the caller yajl_buf_append() skips
a memory write if yajl_buf_ensure_available() failed leading to a data
corruption.

A yajl fork mainter recommended calling memory allocation callbacks with
the large memory request and let them to handle it. But that has the
problem that it's not possible pass the overely large size to the
callbacks.

This patch catches the integer overflow and terminates the process
with abort().

GHSA-jj47-x69x-mxrm

Origin: ppisar/yajl@23cea2d
Bug: lloyd/yajl#239
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040036
likema added a commit to likema/yajl that referenced this issue Dec 2, 2023
@likema
Fix for CVE-2022-24795
533cb97 
An integer overflow will lead to heap memory corruption with large (~2GB) inputs.

Origin: ppisar@23cea2d
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040036
Bug: lloyd#239
@Neustradamus
Copy link

A long time ago, I have done a ticket:

rtobar added a commit to rtobar/yajl that referenced this issue Dec 23, 2024
@rtobar
Fix for CVE-2022-24795
9fd8514 
An integer overflow will lead to heap memory corruption with large (~2GB) inputs.

Origin: ppisar@23cea2d
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040036
Bug: lloyd#239
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@Neustradamus @robohack @anticomputer