ruby-dev

こんにちは、sheepman です。

$SAFE=1のときの dl ライブラリの振る舞いに関してです。

require 'dl'
$SAFE = 1
h = DL.dlopen(nil)
sys = h.sym('system', 'IP')
uname = 'uname -rs'.taint
sys[uname]

という感じで、汚染されている文字列を引数として system を呼べてしまいます。
というわけで、パッチを書いてみました。

DL.dlopen の引数も SafeStringValue でチェックするようにしました。

dl のコードを読むと、String#to_ptr はもとの文字列が汚染されていなくても、常に汚染された
PtrData を返すので、 PtrData.new も常に汚染されたオブジェクトを返すようにしています。

このパッチは後方互換がないので、検討が必要だと思います。

-- 
sheepman / TAMURA Takashi
sheepman@sheepman.sakura.ne.jp

Attachments (1)

dl_safe.pacth.txt (1.1 KB, text/x-diff)

Index: ptr.c
===================================================================
--- ptr.c	(revision 12089)
+++ ptr.c	(working copy)
@@ -176,7 +176,8 @@
   data->size  = 0;
   data->ids   = NULL;
   data->ids_num = 0;
-
+  OBJ_TAINT(obj);
+  
   return obj;
 }
 
Index: sym.c
===================================================================
--- sym.c	(revision 12089)
+++ sym.c	(working copy)
@@ -470,7 +470,8 @@
 
   for( i = sym->len - 2; i >= 0; i-- ){
     dtypes[i] = 0;
-
+    rb_check_safe_obj(argv[i]);
+    
     switch( sym->type[i+1] ){
     case 'p':
       dtypes[i] = 'p';
Index: handle.c
===================================================================
--- handle.c	(revision 12089)
+++ handle.c	(working copy)
@@ -52,10 +52,14 @@
 
   switch (rb_scan_args(argc, argv, "11", &lib, &flag)) {
   case 1:
+    if(!NIL_P(lib))
+      SafeStringValue(lib);
     clib = NIL_P(lib) ? NULL : StringValuePtr(lib);
     cflag = RTLD_LAZY | RTLD_GLOBAL;
     break;
   case 2:
+    if(!NIL_P(lib))
+      SafeStringValue(lib);
     clib = NIL_P(lib) ? NULL : StringValuePtr(lib);
     cflag = NUM2INT(flag);
     break;

Thread

Prev Next

In This Thread

Prev Next

[#30454] [ANN] CVSサービスの廃止 — Shugo Maeda <shugo@...>

[#30455] a[] += 1 で SEGV — "Hiroki Motoyoshi" <himotoyoshi.ml@...>

[#30465] Ruby 1.8.6 delayed for seven days — "Akinori MUSHA" <knu@...>

[#30476] Re: [ruby-cvs:19211] Ruby:r11975: * lib/fileutils.rb (touch): last #touch change causes error when :mtime option was not given. — Nobuyoshi Nakada <nobu@...>

[#30477] ThreadError on shell.rb — "Akira ODA" <oda.org@...>

[#30482] Ruby 1.8.6 preview3 has been released — "Akinori MUSHA" <knu@...>

[#30486] str.lines[1..-1] — Minero Aoki <aamine@...>

[#30487] Time#to_s format — OHARA Shigeki <os@...>

[#30500] MD5.md5 in RubyGems — Kazuhiro Yoshida <moriq@...>

[#30504] num_tとthread_initという名前について — "Yutaka Kanemoto" <kinpoco@...>

[#30505] [BUG?] SIGTERM の取り扱い — Hidetoshi NAGAI <nagai@...>

[#30507] monitor.rb for ruby-1.9 — keiju@... (Keiju ISHITSUKA)

[#30524] DL::Symbol#call dumps core — sheepman <sheepman@...>

[#30530] dl/import is not thread safe — sheepman <sheepman@...>

[#30531] DL::PtrData#to_a dumps core — sheepman <sheepman@...>

[#30532] DL::PtrData#inspect — sheepman <sheepman@...>

[#30536] Ruby 1.8.6 will be released in 24 hours — "Akinori MUSHA" <knu@...>

[#30537] Microsoft-IIS 上で cgi.rb がレスポンス行を２重に出力する — MIYASAKA Masaru <alkaid@...>

[#30547] dl memory leak — sheepman <sheepman@...>

[#30549] [ANN] Ruby 1.8.6 has been released — "Akinori MUSHA" <knu@...>

[#30551] rb_rescue2 with vm — wanabe <s.wanabe@...>

[#30553] help: lib/shell for ruby 1.9 — keiju@... (Keiju ISHITSUKA)

[#30554] rb_ary2cary in dl.c has a bug — sheepman <sheepman@...>

[#30556] ruby 1.8.6のdateとrails — akira yamada / やまだあきら <akira@...>

[#30563] ext/openssl のメンテナについて — "Akinori MUSHA" <knu@...>

[#30564] release code and revision number — Nobuyoshi Nakada <nobu@...>

[#30575] RSS::Parser.parseでSecurityError — Kazuhiro NISHIYAMA <zn@...>

[#30576] Changelog-1.8.6 — moonwolf@...

[#30581] [ruby-core:10580] Thread後のexecでENOTSUPPエラー対応 — "H.Holon" <holon@...>

[#30586] Etc.getgrgid が getgid の値に固定されています — 植田裕之 <ueda@...>

[#30593] [BUG] waitpid for ruby-trunk — keiju@... (Keiju ISHITSUKA)

[#30612] stdout flush in fork — keiju@... (Keiju ISHITSUKA)

[#30615] Etc モジュールのテスト — 植田 裕之 <ueda@...>

[#30618] possible bug in rb_detach_process() — "KUBO Takehiro" <kubo@...>

[#30620] DL.callback as free function causes errors — sheepman <sheepman@...>

[#30622] dl when $SAFE = 1 — sheepman <sheepman@...>

[#30624] test/rdoc occurs errors. — NAKANO Kouichi <curving@...>

[#30627] [ ruby-Bugs-9360 ] Matrix inverse problem — Yukihiro Matsumoto <matz@...>

[#30629] at_exit — keiju@... (Keiju ISHITSUKA)

[#30637] strlcpy and strlcat — "U.Nakamura" <usa@...>

[#30641] Re: [ruby-cvs:19321] Ruby:r12085: fixed the problem reported in — Urabe Shyouhei <shyouhei@...>

[#30648] YARVでのalias名の取得方法 — Yukihiro Matsumoto <matz@...>

[#30653] [BUG] queue 0x424010 freed with live thread(s) waiting — Masatoshi SEKI <m_seki@...>

[#30655] win32/registry wtime — moonwolf@...

[#30657] ロード済み拡張ライブラリの判別 — arton <artonx@...>

[#30667] $! assignment does not work properly — Yukihiro Matsumoto <matz@...>

[#30671] invalid CFP in rb_protect — wanabe <s.wanabe@...>

[#30672] fail to copy argv on Win32? — wanabe <s.wanabe@...>

[#30674] socket blocking on mingw32 — wanabe <s.wanabe@...>

[#30675] coredump on NetBSD with trunk — "U.Nakamura" <usa@...>

[#30676] excel is not closed in runtime using excel.Quit() — "Md. Ruhul Amin" <amin@...>

[ruby-dev:30622] dl when $SAFE = 1

Attachments (1)

Thread

In This Thread

[#30615] Etc モジュールのテスト — 植田裕之 <ueda@...>