Skip to content
This repository was archived by the owner on Jun 1, 2023. It is now read-only.

Commit 85c1f5d

Browse files
rurbanrurban
committed
Storable 3.12_03: fix Limit security issue #393
User limits must not be higher than the probed limits, even pst data might override these limits. Disallow blessing pst data into the Storable package. Protect against setting these via the PST also, the most common attack vector. i.e. hooks may not change these two limits, neither is it now allowed to retrieve from a class Storable or store to a class Storable. Re-add the probed hard limits in stacksize.h, on violations reset the read-write soft limits. Check on Storable init and on every possible change via user-code or data.
1 parent 1d6cbb6 commit 85c1f5d

File tree

14 files changed

+303
-77
lines changed

14 files changed

+303
-77
lines changed

‎MANIFEST‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3643,6 +3643,7 @@ dist/Storable/hints/linux.pl Hint for Storable for named architecture
36433643
dist/Storable/Makefile.PL Storable extension
36443644
dist/Storable/README Storable extension
36453645
dist/Storable/stacksize compute stack sizes
3646+
dist/Storable/stacksize_in.h initial computed stack sizes template
36463647
dist/Storable/Storable.xs Storable extension
36473648
dist/Storable/Storable_pm.PL Storable extension
36483649
dist/Storable/t/attach.t Check STORABLE_attach doesn't create objects unnecessarily

‎Porting/Maintainers.pl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1283,7 +1283,7 @@ package Maintainers;
12831283
},
12841284

12851285
'Storable' => {
1286-
'DISTRIBUTION' => 'RURBAN/Storable-3.12_02.tar.gz',
1286+
'DISTRIBUTION' => 'RURBAN/Storable-3.12_03.tar.gz',
12871287
'FILES' => q[dist/Storable],
12881288
'EXCLUDED' => [
12891289
qw( ptr_table.h t/leaks_refcnt.t .travis.yml appveyor.yml ),

‎dist/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ pm_to_blib
66
Makefile
77
Makefile.PL
88
ppport.h
9+
Storable/stacksize.h
910
Storable/storable-testfile.*
1011
Storable/Storable.pm
1112
Storable/lib/Storable/Limit.pm

‎dist/Module-CoreList/lib/Module/CoreList.pm‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18338,6 +18338,7 @@ our %delta :const = (
1833818338
'B::Op_private' => '5.026005',
1833918339
'Module::CoreList' => '5.20190301c',
1834018340
'Module::CoreList::Utils'=> '5.20190301c',
18341+
'Storable' => '3.12_03',
1834118342
}
1834218343
}
1834318344
);

‎dist/Storable/ChangeLog‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,24 @@
1+
2019-03-01 rurban
2+
Version 3.12_03
3+
* SECURITY: fix p5p-introduced user stacklimits. Must not be higher
4+
than the probed hard limits, when overridden by user code or data,
5+
via hooks or even pst data. [cperl #393]
6+
* Add some author tests as t/z_*.t, add LICENSE and MANIFEST.SKIP
7+
8+
2018-10-17 rurban
9+
Version 3.12_02
10+
* SECURITY: Enable >2GB AvFILL check on store_hook (64bit).
11+
Too many references returned by STORABLE_freeze.
12+
It wrapped around previously. Fixes Coverity CID #187854.
13+
This is a security issue on 64bit cperl and perl5, as both allow
14+
SSize_t arrays.
15+
* Move __Storable__.pm into Storable_pm.PL [cperl #374]
16+
17+
2018-09-05 rurban
18+
Version 3.11_01
19+
* re-add various minor cperl fixes: protect empty hvname,
20+
fixup pod, t/recurse.t
21+
122
2018-04-27 20:40:00 xsawyerx
223
version 3.11
324
* Fix Strawberry Perl build failures.

‎dist/Storable/Makefile.PL‎

Lines changed: 58 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#
22
# Copyright (c) 1995-2000, Raphael Manfredi
3-
# Copyright (c) 2017-2018, Reini Urban
3+
# Copyright (c) 2017-2019, Reini Urban
44
#
55
# You may redistribute only under the same terms as Perl 5, as specified
66
# in the README file that comes with the distribution.
@@ -13,6 +13,8 @@ use Config;
1313
use File::Copy qw(move copy);
1414
use File::Spec;
1515

16+
my ($fn, $in) = ("stacksize.h", "stacksize_in.h");
17+
copy $in, $fn;
1618
unlink "lib/Storable/Limit.pm";
1719

1820
my $limit_pm = File::Spec->catfile('lib', 'Storable', 'Limit.pm');
@@ -25,29 +27,45 @@ unless ($ENV{PERL_CORE}) {
2527

2628
WriteMakefile(
2729
NAME => 'Storable',
28-
AUTHOR => 'Perl 5 Porters',
30+
AUTHOR => 'Reini Urban',
2931
LICENSE => 'perl',
3032
DISTNAME => "Storable",
3133
PL_FILES => { }, # prevent default behaviour
3234
PM => $pm,
33-
PREREQ_PM => { XSLoader => 0 },
35+
PREREQ_PM => { XSLoader => 0, perl => '5.004' },
3436
INSTALLDIRS => ($] >= 5.007 && $] < 5.012) ? 'perl' : 'site',
3537
VERSION_FROM => 'Storable_pm.PL',
3638
ABSTRACT_FROM => 'Storable_pm.PL',
3739
($ExtUtils::MakeMaker::VERSION > 6.45 ?
3840
(META_MERGE => { resources =>
39-
{ bugtracker => 'http://rt.perl.org/perlbug/' },
40-
provides => {
41-
'Storable' => {
42-
file => '__Storable__.pm',
43-
version => MM->parse_version('__Storable__.pm'),
44-
},
45-
},
46-
41+
{ bugtracker => 'http://rt.perl.org/perlbug/',
42+
repository => 'https://github.com/rurban/Storable/',
43+
},
44+
provides => {
45+
'Storable' => {
46+
file => 'Storable_pm.PL',
47+
version => MM->parse_version('Storable_pm.PL'),
4748
},
48-
) : ()),
49+
},
50+
recommends => {
51+
'Test::Kwalitee' => '1.00',
52+
'Test::CheckManifest' => '1.42',
53+
'Test::CPAN::Meta' => 0,
54+
'Pod::Spell::CommonMistakes' => 0,
55+
'Test::Spelling' => 0,
56+
'Test::Pod' => 0,
57+
'Devel::Refcount' => 0,
58+
}
59+
},
60+
) : ()),
61+
($ExtUtils::MakeMaker::VERSION >= 6.64 ?
62+
(TEST_REQUIRES => {
63+
'Test::More' => '0.82', # for t/malice.t using note()
64+
}
65+
) : ()),
4966
dist => { SUFFIX => 'gz', COMPRESS => 'gzip -f' },
50-
clean => { FILES => 'Storable-* Storable.pm lib' },
67+
clean => { FILES => 'Storable-* Storable.pm stacksize.h lib' },
68+
SIGN => 1,
5169
);
5270

5371
# Unlink the .pm file included with the distribution
@@ -77,37 +95,41 @@ EOM
7795
package MY;
7896
use Config;
7997

80-
# FORCE finish of INST_DYNAMIC, avoid loading the old Storable (failed XS_VERSION check)
81-
sub xlinkext {
82-
my $s = shift->SUPER::linkext(@_);
83-
$s =~ s|( :: .*)| $1 FORCE stacksize|;
84-
$s
85-
}
86-
8798
sub depend {
8899
my $extra_deps = "";
89100
my $options = "";
90-
if ($ENV{PERL_CORE}) {
91-
$options = "--core";
92-
}
93-
else {
94-
# blib.pm needs arch/lib
95-
$extra_deps = ' Storable.pm';
96-
}
101+
my $mkblib = '';
97102
my $linktype = uc($_[0]->{LINKTYPE});
103+
my $s;
98104
# EUMM bug for core builds, missing ldlibpthname
99-
my $s = "LDFULLPERLRUNINST = \$(FULLPERLRUNINST)\n";
100-
if ($ENV{PERL_CORE} && $Config{useshrplib}) {
105+
if ($ENV{PERL_CORE}) {
106+
$options = "--core";
107+
# $extra_deps = ' $(PERLEXE)' if $^O eq 'MSWin32';
101108
my $ldlibpthname = $Config{ldlibpthname};
102-
if ($ldlibpthname && $ENV{$ldlibpthname}) {
103-
$s = "LDFULLPERLRUNINST = $ldlibpthname=$ENV{$ldlibpthname}" .
104-
" \$(FULLPERLRUNINST)\n";
109+
if ($Config{useshrplib} && $ldlibpthname && $ENV{$ldlibpthname}) {
110+
$s = "LDPERLRUNINST = $ldlibpthname=$ENV{$ldlibpthname}" .
111+
" \$(FULLPERLRUNINST)\n";
112+
} else {
113+
$s = "LDPERLRUNINST = \$(FULLPERLRUNINST)\n";
105114
}
115+
} else {
116+
# blib.pm needs arch/lib
117+
$extra_deps = ' Storable.pm';
118+
$s = "LDPERLRUNINST = \$(FULLPERLRUNINST)\n";
119+
$mkblib = "-\$(MKPATH) \$(INST_ARCHLIB)\n\t" .
120+
"-\$(CHMOD) \$(PERM_RW) \$(INST_ARCHLIB)/Storable.pm\n\t" .
121+
"\$(CP) Storable.pm \$(INST_ARCHLIB)/Storable.pm\n\t";
106122
}
107123
$s . "
108-
$limit_pm : stacksize \$(INST_$linktype)$extra_deps
109-
\$(MKPATH) \$(INST_LIB)
110-
\$(LDFULLPERLRUNINST) stacksize $options
124+
stacksize: Makefile \$(INST_$linktype)$extra_deps
125+
$mkblib\$(LDPERLRUNINST) stacksize $options
126+
127+
Storable\$(OBJ_EXT) Storable.c: stacksize.h
128+
129+
stacksize.h: stacksize_in.h
130+
\$(CP) stacksize_in.h stacksize.h
131+
132+
$limit_pm : stacksize
111133
112134
release : dist
113135
git tag \$(VERSION)
@@ -136,5 +158,6 @@ all :: Storable.pm
136158
137159
Storable.pm :: Storable_pm.PL
138160
$(PERLRUN) Storable_pm.PL
161+
139162
'
140163
}

‎dist/Storable/README‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
1-
Storable 3.11_01
2-
Copyright (c) 1995-2000, Raphael Manfredi
3-
Copyright (c) 2001-2004, Larry Wall
4-
Copyright (c) 2016,2017 cPanel Inc
5-
Copyright (c) 2015-2016 cPanel Inc
6-
Copyright (c) 2017-2018 Reini Urban
1+
Storable 3.12_03
2+
Copyright (c) 1995-2000 Raphael Manfredi
3+
Copyright (c) 2001-2004 Larry Wall
4+
Copyright (c) 2015-2017 cPanel Inc
5+
Copyright (c) 2017-2019 Reini Urban
76
Copyright (c) 2017-2018 by the Perl 5 Porters
87

98
------------------------------------------------------------------------
@@ -74,7 +73,7 @@ Thanks to (in chronological order):
7473
Albert N. Micheev <Albert.N.Micheev@f80.n5049.z2.fidonet.org>
7574
Marc Lehmann <pcg@opengroup.org>
7675
Justin Banks <justinb@wamnet.com>
77-
Jarkko Hietaniemi <jhi@iki.fi> (AGAIN, as perl 5.7.0 Pumpkin!)
76+
Jarkko Hietaniemi <jhi@iki.fi> (AGAIN, as perl 5.7.0 Pumpkin)
7877
Todd Rinaldo <toddr@cpanel.net> and JD Lightsey <jd@cpanel.net>
7978
for optional disabling tie and bless for increased security.
8079
Reini Urban <rurban@cpanel.net> for the 3.0x >2G support and rewrite

0 commit comments

Comments
 (0)