Skip to content
Snippets Groups Projects

go [dunfell]: backport fix for CVE-2022-23772 and CVE-2022-23806

Merged Davide Gardenal requested to merge tony3oo3/oniro:fix_dunfell_CVEs into dunfell
All threads resolved!
Files
3
From 70882eedccac803ddcf1c3215e0ae8fd59847e39 Mon Sep 17 00:00:00 2001
From: Katie Hockman <katie@golang.org>
Date: Sat, 26 Feb 2022 20:03:38 +0000
Subject: [PATCH] [release-branch.go1.16] math/big: prevent overflow in
(*Rat).SetString
Credit to rsc@ for the original patch.
Thanks to the OSS-Fuzz project for discovering this
issue and to Emmanuel Odeke (@odeke_et) for reporting it.
Updates #50699
Fixes #50700
Fixes CVE-2022-23772
Upstream-url: https://git.openembedded.org/openembedded-core-contrib/commit/?h=jansa/dunfell&id=e4d15040f62744265b9236ad7276f3371a9172da
Upstream-Status: Accepted
CVE: CVE-2022-23772
Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
---
src/math/big/ratconv.go | 5 +++++
src/math/big/ratconv_test.go | 1 +
2 files changed, 6 insertions(+)
diff --git a/src/math/big/ratconv.go b/src/math/big/ratconv.go
index 941139e..e8cbdbe 100644
--- a/src/math/big/ratconv.go
+++ b/src/math/big/ratconv.go
@@ -168,6 +168,11 @@ func (z *Rat) SetString(s string) (*Rat, bool) {
n := exp5
if n < 0 {
n = -n
+ if n < 0 {
+ // This can occur if -n overflows. -(-1 << 63) would become
+ // -1 << 63, which is still negative.
+ return nil, false
+ }
}
pow5 := z.b.abs.expNN(natFive, nat(nil).setWord(Word(n)), nil) // use underlying array of z.b.abs
if exp5 > 0 {
diff --git a/src/math/big/ratconv_test.go b/src/math/big/ratconv_test.go
index ba0d1ba..b820df4 100644
--- a/src/math/big/ratconv_test.go
+++ b/src/math/big/ratconv_test.go
@@ -104,6 +104,7 @@ var setStringTests = []StringTest{
{in: "4/3/"},
{in: "4/3."},
{in: "4/"},
+ {in: "13e-9223372036854775808"}, // CVE-2022-23772
// valid
{"0", "0", true},
--
2.17.1
Loading