ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

external/nss: Fix out-of-bounds read

Browse Source 
Ever since 879668c9ba "MOZILLA_CERTIFICATE_FOLDER
needs to be non-empty to disable autodetect..." we have in
engine/solenv/gbuild/gbuild.mk:

> # * Disable searching for certificates by default:
> #
> #  see xmlsecurity/source/xmlsec/nss/nssinitializer.cxx for use
> #
> #  a) If MOZILLA_CERTIFICATE_FOLDER is empty then LibreOffice autodetects
> #  the user's mozilla-descended application profile. To disable that we
> #  use a non-empty string here.
> #
> #  b) Using dbm: appears to nss as equivalent to an empty path so the
> #  initial NSS_InitReadWrite will fail. In response to that failure
> #  LibreOffice will create a temp fallback cert database which is removed
> #  on process exit
> gb_TEST_ENV_VARS += MOZILLA_CERTIFICATE_FOLDER=dbm:

Which leads to a call of NSS_InitReadWrite("dbm:") in nsscrypto_initialize
(engine/xmlsecurity/source/xmlsec/nss/nssinitializer.cxx), which reaches
nss_Init, which recognizes the "dbm:" prefix and strips it, leaving an empty
config directory.  If no root certificate module is loaded yet
(SECMOD_HasRootCerts() is false, which is the case in an environment that has no
NSS root certs) nss_Init then calls nss_FindExternalRoot with that empty path,
causing an out-of-bounds read of path[-1] at

>     if (path[path_len - 1] != FILE_SEP)

Signed-off-by: Stephan Bergmann <stephan.bergmann@collabora.com>
Change-Id: I45d8cbc236b47f6fbf082e5d48bd99abda71e7f0
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/4138
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 0cc0fa8ea35441d752aa601921d800c9e479b823)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/206355
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
This commit is contained in:
Stephan Bergmann
2026-06-12 12:30:00 +02:00
committed by Xisco Fauli
parent adb6b36314
commit 9cd7ef2e7e
2 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
external/nss/UnpackedTarball_nss.mk
Vendored
+1
View File
@@ -41,6 +41,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
external/nss/nss.windows.patch \
external/nss/nss.nowerror.patch \
external/nss/nss.utf8bom.patch.1) \
external/nss/outofbounds.patch.0 \
))
ifeq ($(COM_IS_CLANG),TRUE)
external/nss/outofbounds.patch.0
Vendored
+11
View File
@@ -0,0 +1,11 @@
--- nss/lib/nss/nssinit.c
+++ nss/lib/nss/nssinit.c
@@ -289,7 +289,7 @@
/* back up to the top of the directory */
PORT_Memcpy(path, dbpath, path_len);
- if (path[path_len - 1] != FILE_SEP) {
+ if (path_len == 0 || path[path_len - 1] != FILE_SEP) {
path[path_len++] = FILE_SEP;
}
PORT_Strcpy(&path[path_len], dllname);