[sword-devel] Major Sword bug found -- buffer overflow
DM Smith
dmsmith555 at yahoo.com
Thu Mar 2 11:27:44 MST 2006
Off the top of my head:
My basic thought is that perhaps it is possible to use something known
about the module to determine whether the unlock was good.
Perhaps on entry of an unlock key, text could be grabbed from the module
and deciphered and then compared to something expected.
Today a module is one of a few different markups (GBF, ThML, OSIS,
PlainText) and encodings (cp1252 and UTF-8).
With regard to the encodings each has some bit patterns that are not
allowed. It may be possible to detect them for locked modules. E.g.
after decompression, read several hundred bytes from the beginning of
the file and look for bad characters or character sequences. E.g. Latin
1 should have some sequences of words containing mostly unaccented
characters and spaces every few characters.
With regard to markup, one would expect certain sequences to be present
for GBF, ThML and OSIS. And for xml certain characters (e.g. control
characters) are not allowed. I don't imagine that non-whitespace control
characters are of any use for GBF or PlainText as well.
Another thought, what if the "encryption" would place the key at the end
of the "block", which I think is outside of where the current processes
would look for it. If decryption of the block yielded the key, then the
key was correct.
I don't think there is anything that can prevent a brute force attack.
The strength of encryption (i.e. key length and algorithm) is what makes
it hard to break. Having a system respond as to whether the key is good
or not does not make it any easier to break. (With the code today, it
would not be to hard to write a routine that would provide feedback.)
I think there is a greater risk to sharing of keys or outright stealing
once a key is legitimately obtained.
Troy A. Griffitts wrote:
> Hey guys,
> Sadly, we've known about this since we implemented cipher support.
> There may be a bug in sapphire, as DM points out, but here's the real
> problem:
>
> To implement cipher support more securely, we have no way to know
> if the user has entered a correct key.
>
> Consider why. If there was a confirmation of the correct key,
> then anyone could brute force all the unlock keys fairly easily. As
> it stands now, if they have the correct key, they see correct text,
> otherwise, they see jibberish.
>
> The major problem is that most of our filters don't do a good job
> with invalid markup (consider jibberish can have <>[] and other meta
> characters).
>
> So, now how do we protect against the situation which Martin
> points out:
>
> A user has a locked module installed and has entered an invalid key.
>
>
> Granted, a good first step is to make our filters' error handling
> more robust-- which could never be a bad thing, done without
> optization hits.
>
> Other suggestions are most welcomed.
>
> -Troy.
>
>
>
> Martin Gruner wrote:
>> Hi,
>>
>> sorry for my misunderstanding of how Sword internals work.
>>
>> However, the problem is there, it may be something in the
>> decompression algorithm. I'm attaching a valgrind trace of the crash
>> in BibleTime when I try to open the GerHfaLex2002 without a valid key.
>>
>> mg
>>
>> --
>>
>> no room in outbuffer to during decompression. see zipcomp.cpp
>> ==6598==
>> ==6598== Conditional jump or move depends on uninitialised value(s)
>> ==6598== at 0x599FD16: sword::EntriesBlock::getMetaEntry(int,
>> unsigned long*, unsigned long*) (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599FFC7: sword::EntriesBlock::getEntrySize(int) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599EBDA: sword::zStr::getCompressedText(long, long,
>> char**) (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599FB28: sword::zStr::getText(long, char**, char**)
>> (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0644: sword::zLD::getEntry(long) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F08DF: sword::zLD::getRawEntryBuf() (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59EEC61:
>> sword::SWLD::setPosition(sword::SW_POSITION) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x812B19E: CSwordLexiconModuleInfo::entries() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80ACF99: CLexiconKeyChooser::refreshContent() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80AD702:
>> CLexiconKeyChooser::CLexiconKeyChooser(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*, char const*) (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80A45FE:
>> CKeyChooser::createInstance(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x808785B: CLexiconReadWindow::initView() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598==
>> ==6598== Conditional jump or move depends on uninitialised value(s)
>> ==6598== at 0x599FD16: sword::EntriesBlock::getMetaEntry(int,
>> unsigned long*, unsigned long*) (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599FF78: sword::EntriesBlock::getEntry(int) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599EC0F: sword::zStr::getCompressedText(long, long,
>> char**) (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599FB28: sword::zStr::getText(long, char**, char**)
>> (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0644: sword::zLD::getEntry(long) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F08DF: sword::zLD::getRawEntryBuf() (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59EEC61:
>> sword::SWLD::setPosition(sword::SW_POSITION) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x812B19E: CSwordLexiconModuleInfo::entries() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80ACF99: CLexiconKeyChooser::refreshContent() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80AD702:
>> CLexiconKeyChooser::CLexiconKeyChooser(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*, char const*) (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80A45FE:
>> CKeyChooser::createInstance(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x808785B: CLexiconReadWindow::initView() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> no room in outbuffer to during decompression. see zipcomp.cpp
>> ==6598==
>> ==6598== Conditional jump or move depends on uninitialised value(s)
>> ==6598== at 0x599FFD0: sword::EntriesBlock::getEntrySize(int) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599EBDA: sword::zStr::getCompressedText(long, long,
>> char**) (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599FB28: sword::zStr::getText(long, char**, char**)
>> (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0644: sword::zLD::getEntry(long) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0824: sword::zLD::increment(int) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x812B263: CSwordLexiconModuleInfo::entries() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80ACF99: CLexiconKeyChooser::refreshContent() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80AD702:
>> CLexiconKeyChooser::CLexiconKeyChooser(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*, char const*) (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80A45FE:
>> CKeyChooser::createInstance(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x808785B: CLexiconReadWindow::initView() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80868AE: CDisplayWindow::init() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x807E11E:
>> BibleTime::createReadDisplayWindow(QValueList<CSwordModuleInfo*>,
>> QString const&) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598==
>> ==6598== Conditional jump or move depends on uninitialised value(s)
>> ==6598== at 0x599FF81: sword::EntriesBlock::getEntry(int) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599EC0F: sword::zStr::getCompressedText(long, long,
>> char**) (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599FB28: sword::zStr::getText(long, char**, char**)
>> (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0644: sword::zLD::getEntry(long) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0824: sword::zLD::increment(int) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x812B263: CSwordLexiconModuleInfo::entries() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80ACF99: CLexiconKeyChooser::refreshContent() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80AD702:
>> CLexiconKeyChooser::CLexiconKeyChooser(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*, char const*) (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80A45FE:
>> CKeyChooser::createInstance(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x808785B: CLexiconReadWindow::initView() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80868AE: CDisplayWindow::init() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x807E11E:
>> BibleTime::createReadDisplayWindow(QValueList<CSwordModuleInfo*>,
>> QString const&) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598==
>> ==6598== Conditional jump or move depends on uninitialised value(s)
>> ==6598== at 0x401D917: realloc (vg_replace_malloc.c:306)
>> ==6598== by 0x599EBF7: sword::zStr::getCompressedText(long, long,
>> char**) (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599FB28: sword::zStr::getText(long, char**, char**)
>> (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0644: sword::zLD::getEntry(long) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0824: sword::zLD::increment(int) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x812B263: CSwordLexiconModuleInfo::entries() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80ACF99: CLexiconKeyChooser::refreshContent() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80AD702:
>> CLexiconKeyChooser::CLexiconKeyChooser(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*, char const*) (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80A45FE:
>> CKeyChooser::createInstance(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x808785B: CLexiconReadWindow::initView() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80868AE: CDisplayWindow::init() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x807E11E:
>> BibleTime::createReadDisplayWindow(QValueList<CSwordModuleInfo*>,
>> QString const&) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598==
>> ==6598== Use of uninitialised value of size 4
>> ==6598== at 0x401E7AA: strcpy (mac_replace_strmem.c:269)
>> ==6598== by 0x599EC1D: sword::zStr::getCompressedText(long, long,
>> char**) (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599FB28: sword::zStr::getText(long, char**, char**)
>> (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0644: sword::zLD::getEntry(long) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0824: sword::zLD::increment(int) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x812B263: CSwordLexiconModuleInfo::entries() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80ACF99: CLexiconKeyChooser::refreshContent() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80AD702:
>> CLexiconKeyChooser::CLexiconKeyChooser(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*, char const*) (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80A45FE:
>> CKeyChooser::createInstance(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x808785B: CLexiconReadWindow::initView() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80868AE: CDisplayWindow::init() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x807E11E:
>> BibleTime::createReadDisplayWindow(QValueList<CSwordModuleInfo*>,
>> QString const&) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598==
>> ==6598== Conditional jump or move depends on uninitialised value(s)
>> ==6598== at 0x401E7B3: strcpy (mac_replace_strmem.c:269)
>> ==6598== by 0x599EC1D: sword::zStr::getCompressedText(long, long,
>> char**) (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599FB28: sword::zStr::getText(long, char**, char**)
>> (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0644: sword::zLD::getEntry(long) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0824: sword::zLD::increment(int) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x812B263: CSwordLexiconModuleInfo::entries() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80ACF99: CLexiconKeyChooser::refreshContent() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80AD702:
>> CLexiconKeyChooser::CLexiconKeyChooser(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*, char const*) (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80A45FE:
>> CKeyChooser::createInstance(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x808785B: CLexiconReadWindow::initView() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80868AE: CDisplayWindow::init() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x807E11E:
>> BibleTime::createReadDisplayWindow(QValueList<CSwordModuleInfo*>,
>> QString const&) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598==
>> ==6598== Conditional jump or move depends on uninitialised value(s)
>> ==6598== at 0x401E7DC: strcpy (mac_replace_strmem.c:69)
>> ==6598== by 0x599EC1D: sword::zStr::getCompressedText(long, long,
>> char**) (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599FB28: sword::zStr::getText(long, char**, char**)
>> (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0644: sword::zLD::getEntry(long) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0824: sword::zLD::increment(int) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x812B263: CSwordLexiconModuleInfo::entries() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80ACF99: CLexiconKeyChooser::refreshContent() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80AD702:
>> CLexiconKeyChooser::CLexiconKeyChooser(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*, char const*) (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80A45FE:
>> CKeyChooser::createInstance(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x808785B: CLexiconReadWindow::initView() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80868AE: CDisplayWindow::init() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x807E11E:
>> BibleTime::createReadDisplayWindow(QValueList<CSwordModuleInfo*>,
>> QString const&) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598== Warning: set address range perms: large range 243302452, a
>> 0, v 1
>> ==6598== Warning: set address range perms: large range 243302481, a
>> 1, v 1
>> ==6598== Warning: silly arg (-2147483639) to realloc()
>> ==6598==
>> ==6598== Invalid write of size 1
>> ==6598== at 0x401E7C0: strcpy (mac_replace_strmem.c:269)
>> ==6598== by 0x599EC1D: sword::zStr::getCompressedText(long, long,
>> char**) (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x599FB28: sword::zStr::getText(long, char**, char**)
>> (in /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0644: sword::zLD::getEntry(long) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x59F0824: sword::zLD::increment(int) (in
>> /usr/lib/libsword.so.5.0.0)
>> ==6598== by 0x812B263: CSwordLexiconModuleInfo::entries() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80ACF99: CLexiconKeyChooser::refreshContent() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80AD702:
>> CLexiconKeyChooser::CLexiconKeyChooser(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*, char const*) (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80A45FE:
>> CKeyChooser::createInstance(QValueList<CSwordModuleInfo*>,
>> CSwordKey*, QWidget*) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x808785B: CLexiconReadWindow::initView() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x80868AE: CDisplayWindow::init() (in
>> /home/dev/bibletime/bibletime/bibletime)
>> ==6598== by 0x807E11E:
>> BibleTime::createReadDisplayWindow(QValueList<CSwordModuleInfo*>,
>> QString const&) (in /home/dev/bibletime/bibletime/bibletime)
>> ==6598== Address 0x0 is not stack'd, malloc'd or (recently) free'd
>> *** BibleTime got signal 11 (Crashing). Trying to save settings.
>> _______________________________________________
>> sword-devel mailing list: sword-devel at crosswire.org
>> http://www.crosswire.org/mailman/listinfo/sword-devel
>> Instructions to unsubscribe/change your settings at above page
>
> _______________________________________________
> sword-devel mailing list: sword-devel at crosswire.org
> http://www.crosswire.org/mailman/listinfo/sword-devel
> Instructions to unsubscribe/change your settings at above page
>
More information about the sword-devel
mailing list