mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-10-30 12:25:10 +01:00
Ed Maste
ef4b7f1de7
r304691: bspatch: apply style(9) Make style changes (and trivial refactoring of open calls) now in order to reduce noise in diffs for future capsicum changes. r304807 (allanjude): Capsicumize bspatch Move all of the fopen() and open() calls to the top of main() Restrict each FD to least privilege (read/seek only, write only, etc) cap_enter(), and make all except the output FD read/seek only. r304821: bspatch: remove output file in the case of error r305486: bspatch: add sanity checks on sizes to avoid integer overflow Note that this introduces an explicit 2GB limit, but this was already implicit in variable and function argument types. This is based on the "non-cryptanalytic attacks against freebsd update components" anonymous gist. Further refinement is planned. r305737: bspatch: remove superfluous newlines from errx strings r305822: bspatch: use #define for header size instead of magic number r306026: bspatch: Remove backwards-compatibility sys/capability.h support bspatch previously included sys/capability.h or sys/capsicum.h based on __FreeBSD_version, as FreeBSD is the upstream for bsdiff and we may see this file incorporated into other third-party software. The Capsicum header is now installed as sys/capsicum.h in stable/10 and FreeBSD 10.3, so we can just use sys/capsicum.h and simplify the logic.
299 lines
8.3 KiB
C
299 lines
8.3 KiB
C
/*-
|
|
* Copyright 2003-2005 Colin Percival
|
|
* All rights reserved
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted providing that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
|
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
|
|
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
|
|
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#include <sys/cdefs.h>
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
#if defined(__FreeBSD__)
|
|
#include <sys/param.h>
|
|
#if __FreeBSD_version >= 1001511
|
|
#include <sys/capsicum.h>
|
|
#define HAVE_CAPSICUM
|
|
#endif
|
|
#endif
|
|
|
|
#include <bzlib.h>
|
|
#include <err.h>
|
|
#include <errno.h>
|
|
#include <fcntl.h>
|
|
#include <libgen.h>
|
|
#include <limits.h>
|
|
#include <stdint.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
|
|
#ifndef O_BINARY
|
|
#define O_BINARY 0
|
|
#endif
|
|
#define HEADER_SIZE 32
|
|
|
|
static char *newfile;
|
|
static int dirfd = -1;
|
|
|
|
static void
|
|
exit_cleanup(void)
|
|
{
|
|
|
|
if (dirfd != -1 && newfile != NULL)
|
|
if (unlinkat(dirfd, newfile, 0))
|
|
warn("unlinkat");
|
|
}
|
|
|
|
static off_t offtin(u_char *buf)
|
|
{
|
|
off_t y;
|
|
|
|
y = buf[7] & 0x7F;
|
|
y = y * 256; y += buf[6];
|
|
y = y * 256; y += buf[5];
|
|
y = y * 256; y += buf[4];
|
|
y = y * 256; y += buf[3];
|
|
y = y * 256; y += buf[2];
|
|
y = y * 256; y += buf[1];
|
|
y = y * 256; y += buf[0];
|
|
|
|
if (buf[7] & 0x80)
|
|
y = -y;
|
|
|
|
return (y);
|
|
}
|
|
|
|
static void
|
|
usage(void)
|
|
{
|
|
|
|
fprintf(stderr, "usage: bspatch oldfile newfile patchfile\n");
|
|
exit(1);
|
|
}
|
|
|
|
int main(int argc, char *argv[])
|
|
{
|
|
FILE *f, *cpf, *dpf, *epf;
|
|
BZFILE *cpfbz2, *dpfbz2, *epfbz2;
|
|
char *directory, *namebuf;
|
|
int cbz2err, dbz2err, ebz2err;
|
|
int newfd, oldfd;
|
|
off_t oldsize, newsize;
|
|
off_t bzctrllen, bzdatalen;
|
|
u_char header[HEADER_SIZE], buf[8];
|
|
u_char *old, *new;
|
|
off_t oldpos, newpos;
|
|
off_t ctrl[3];
|
|
off_t i, lenread, offset;
|
|
#ifdef HAVE_CAPSICUM
|
|
cap_rights_t rights_dir, rights_ro, rights_wr;
|
|
#endif
|
|
|
|
if (argc != 4)
|
|
usage();
|
|
|
|
/* Open patch file */
|
|
if ((f = fopen(argv[3], "rb")) == NULL)
|
|
err(1, "fopen(%s)", argv[3]);
|
|
/* Open patch file for control block */
|
|
if ((cpf = fopen(argv[3], "rb")) == NULL)
|
|
err(1, "fopen(%s)", argv[3]);
|
|
/* open patch file for diff block */
|
|
if ((dpf = fopen(argv[3], "rb")) == NULL)
|
|
err(1, "fopen(%s)", argv[3]);
|
|
/* open patch file for extra block */
|
|
if ((epf = fopen(argv[3], "rb")) == NULL)
|
|
err(1, "fopen(%s)", argv[3]);
|
|
/* open oldfile */
|
|
if ((oldfd = open(argv[1], O_RDONLY | O_BINARY, 0)) < 0)
|
|
err(1, "open(%s)", argv[1]);
|
|
/* open directory where we'll write newfile */
|
|
if ((namebuf = strdup(argv[2])) == NULL ||
|
|
(directory = dirname(namebuf)) == NULL ||
|
|
(dirfd = open(directory, O_DIRECTORY)) < 0)
|
|
err(1, "open %s", argv[2]);
|
|
free(namebuf);
|
|
if ((newfile = basename(argv[2])) == NULL)
|
|
err(1, "basename");
|
|
/* open newfile */
|
|
if ((newfd = openat(dirfd, newfile,
|
|
O_CREAT | O_TRUNC | O_WRONLY | O_BINARY, 0666)) < 0)
|
|
err(1, "open(%s)", argv[2]);
|
|
atexit(exit_cleanup);
|
|
|
|
#ifdef HAVE_CAPSICUM
|
|
if (cap_enter() < 0) {
|
|
/* Failed to sandbox, fatal if CAPABILITY_MODE enabled */
|
|
if (errno != ENOSYS)
|
|
err(1, "failed to enter security sandbox");
|
|
} else {
|
|
/* Capsicum Available */
|
|
cap_rights_init(&rights_ro, CAP_READ, CAP_FSTAT, CAP_SEEK);
|
|
cap_rights_init(&rights_wr, CAP_WRITE);
|
|
cap_rights_init(&rights_dir, CAP_UNLINKAT);
|
|
|
|
if (cap_rights_limit(fileno(f), &rights_ro) < 0 ||
|
|
cap_rights_limit(fileno(cpf), &rights_ro) < 0 ||
|
|
cap_rights_limit(fileno(dpf), &rights_ro) < 0 ||
|
|
cap_rights_limit(fileno(epf), &rights_ro) < 0 ||
|
|
cap_rights_limit(oldfd, &rights_ro) < 0 ||
|
|
cap_rights_limit(newfd, &rights_wr) < 0 ||
|
|
cap_rights_limit(dirfd, &rights_dir) < 0)
|
|
err(1, "cap_rights_limit() failed, could not restrict"
|
|
" capabilities");
|
|
}
|
|
#endif
|
|
|
|
/*
|
|
File format:
|
|
0 8 "BSDIFF40"
|
|
8 8 X
|
|
16 8 Y
|
|
24 8 sizeof(newfile)
|
|
32 X bzip2(control block)
|
|
32+X Y bzip2(diff block)
|
|
32+X+Y ??? bzip2(extra block)
|
|
with control block a set of triples (x,y,z) meaning "add x bytes
|
|
from oldfile to x bytes from the diff block; copy y bytes from the
|
|
extra block; seek forwards in oldfile by z bytes".
|
|
*/
|
|
|
|
/* Read header */
|
|
if (fread(header, 1, HEADER_SIZE, f) < HEADER_SIZE) {
|
|
if (feof(f))
|
|
errx(1, "Corrupt patch");
|
|
err(1, "fread(%s)", argv[3]);
|
|
}
|
|
|
|
/* Check for appropriate magic */
|
|
if (memcmp(header, "BSDIFF40", 8) != 0)
|
|
errx(1, "Corrupt patch");
|
|
|
|
/* Read lengths from header */
|
|
bzctrllen = offtin(header + 8);
|
|
bzdatalen = offtin(header + 16);
|
|
newsize = offtin(header + 24);
|
|
if (bzctrllen < 0 || bzctrllen > OFF_MAX - HEADER_SIZE ||
|
|
bzdatalen < 0 || bzctrllen + HEADER_SIZE > OFF_MAX - bzdatalen ||
|
|
newsize < 0 || newsize > SSIZE_MAX)
|
|
errx(1, "Corrupt patch");
|
|
|
|
/* Close patch file and re-open it via libbzip2 at the right places */
|
|
if (fclose(f))
|
|
err(1, "fclose(%s)", argv[3]);
|
|
offset = HEADER_SIZE;
|
|
if (fseeko(cpf, offset, SEEK_SET))
|
|
err(1, "fseeko(%s, %jd)", argv[3], (intmax_t)offset);
|
|
if ((cpfbz2 = BZ2_bzReadOpen(&cbz2err, cpf, 0, 0, NULL, 0)) == NULL)
|
|
errx(1, "BZ2_bzReadOpen, bz2err = %d", cbz2err);
|
|
offset += bzctrllen;
|
|
if (fseeko(dpf, offset, SEEK_SET))
|
|
err(1, "fseeko(%s, %jd)", argv[3], (intmax_t)offset);
|
|
if ((dpfbz2 = BZ2_bzReadOpen(&dbz2err, dpf, 0, 0, NULL, 0)) == NULL)
|
|
errx(1, "BZ2_bzReadOpen, bz2err = %d", dbz2err);
|
|
offset += bzdatalen;
|
|
if (fseeko(epf, offset, SEEK_SET))
|
|
err(1, "fseeko(%s, %jd)", argv[3], (intmax_t)offset);
|
|
if ((epfbz2 = BZ2_bzReadOpen(&ebz2err, epf, 0, 0, NULL, 0)) == NULL)
|
|
errx(1, "BZ2_bzReadOpen, bz2err = %d", ebz2err);
|
|
|
|
if ((oldsize = lseek(oldfd, 0, SEEK_END)) == -1 ||
|
|
oldsize > SSIZE_MAX ||
|
|
(old = malloc(oldsize)) == NULL ||
|
|
lseek(oldfd, 0, SEEK_SET) != 0 ||
|
|
read(oldfd, old, oldsize) != oldsize ||
|
|
close(oldfd) == -1)
|
|
err(1, "%s", argv[1]);
|
|
if ((new = malloc(newsize)) == NULL)
|
|
err(1, NULL);
|
|
|
|
oldpos = 0;
|
|
newpos = 0;
|
|
while (newpos < newsize) {
|
|
/* Read control data */
|
|
for (i = 0; i <= 2; i++) {
|
|
lenread = BZ2_bzRead(&cbz2err, cpfbz2, buf, 8);
|
|
if ((lenread < 8) || ((cbz2err != BZ_OK) &&
|
|
(cbz2err != BZ_STREAM_END)))
|
|
errx(1, "Corrupt patch");
|
|
ctrl[i] = offtin(buf);
|
|
}
|
|
|
|
/* Sanity-check */
|
|
if (ctrl[0] < 0 || ctrl[0] > INT_MAX ||
|
|
ctrl[1] < 0 || ctrl[1] > INT_MAX)
|
|
errx(1, "Corrupt patch");
|
|
|
|
/* Sanity-check */
|
|
if (newpos + ctrl[0] > newsize)
|
|
errx(1, "Corrupt patch");
|
|
|
|
/* Read diff string */
|
|
lenread = BZ2_bzRead(&dbz2err, dpfbz2, new + newpos, ctrl[0]);
|
|
if ((lenread < ctrl[0]) ||
|
|
((dbz2err != BZ_OK) && (dbz2err != BZ_STREAM_END)))
|
|
errx(1, "Corrupt patch");
|
|
|
|
/* Add old data to diff string */
|
|
for (i = 0; i < ctrl[0]; i++)
|
|
if ((oldpos + i >= 0) && (oldpos + i < oldsize))
|
|
new[newpos + i] += old[oldpos + i];
|
|
|
|
/* Adjust pointers */
|
|
newpos += ctrl[0];
|
|
oldpos += ctrl[0];
|
|
|
|
/* Sanity-check */
|
|
if (newpos + ctrl[1] > newsize)
|
|
errx(1, "Corrupt patch");
|
|
|
|
/* Read extra string */
|
|
lenread = BZ2_bzRead(&ebz2err, epfbz2, new + newpos, ctrl[1]);
|
|
if ((lenread < ctrl[1]) ||
|
|
((ebz2err != BZ_OK) && (ebz2err != BZ_STREAM_END)))
|
|
errx(1, "Corrupt patch");
|
|
|
|
/* Adjust pointers */
|
|
newpos+=ctrl[1];
|
|
oldpos+=ctrl[2];
|
|
}
|
|
|
|
/* Clean up the bzip2 reads */
|
|
BZ2_bzReadClose(&cbz2err, cpfbz2);
|
|
BZ2_bzReadClose(&dbz2err, dpfbz2);
|
|
BZ2_bzReadClose(&ebz2err, epfbz2);
|
|
if (fclose(cpf) || fclose(dpf) || fclose(epf))
|
|
err(1, "fclose(%s)", argv[3]);
|
|
|
|
/* Write the new file */
|
|
if (write(newfd, new, newsize) != newsize || close(newfd) == -1)
|
|
err(1, "%s", argv[2]);
|
|
/* Disable atexit cleanup */
|
|
newfile = NULL;
|
|
|
|
free(new);
|
|
free(old);
|
|
|
|
return (0);
|
|
}
|