From f27c12d491955c94583512603bf32c4568f20929 Mon Sep 17 00:00:00 2001
|
From: Michael Walz <code@serpedon.de>
|
Date: Tue, 2 Feb 2021 00:50:29 +0100
|
Subject: [PATCH] Store a copy of each serialized shared_ptr within the archive
|
to prevent the shared_ptr to be freed to early. (#667)
|
|
The archives use the memory address pointed by the shared_ptr as a
|
unique id which must not be reused during lifetime of the archive.
|
Therefore, the archives stores a copy of it.
|
This problem was also reported as CVE-2020-11105.
|
|
[Retrieved from:
|
https://github.com/USCiLab/cereal/commit/f27c12d491955c94583512603bf32c4568f20929]
|
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
|
---
|
include/cereal/cereal.hpp | 13 +++++++++++--
|
include/cereal/types/memory.hpp | 2 +-
|
2 files changed, 12 insertions(+), 3 deletions(-)
|
|
diff --git a/include/cereal/cereal.hpp b/include/cereal/cereal.hpp
|
index 99bed9d6..f0d15e8b 100644
|
--- a/include/cereal/cereal.hpp
|
+++ b/include/cereal/cereal.hpp
|
@@ -369,12 +369,17 @@ namespace cereal
|
point to the same data.
|
|
@internal
|
- @param addr The address (see shared_ptr get()) pointed to by the shared pointer
|
+ @param sharedPointer The shared pointer itself (the adress is taked via get()).
|
+ The archive takes a copy to prevent the memory location to be freed
|
+ as long as the address is used as id. This is needed to prevent CVE-2020-11105.
|
@return A key that uniquely identifies the pointer */
|
- inline std::uint32_t registerSharedPointer( void const * addr )
|
+ inline std::uint32_t registerSharedPointer(const std::shared_ptr<const void>& sharedPointer)
|
{
|
+ void const * addr = sharedPointer.get();
|
+
|
// Handle null pointers by just returning 0
|
if(addr == 0) return 0;
|
+ itsSharedPointerStorage.push_back(sharedPointer);
|
|
auto id = itsSharedPointerMap.find( addr );
|
if( id == itsSharedPointerMap.end() )
|
@@ -645,6 +650,10 @@ namespace cereal
|
//! Maps from addresses to pointer ids
|
std::unordered_map<void const *, std::uint32_t> itsSharedPointerMap;
|
|
+ //! Copy of shared pointers used in #itsSharedPointerMap to make sure they are kept alive
|
+ // during lifetime of itsSharedPointerMap to prevent CVE-2020-11105.
|
+ std::vector<std::shared_ptr<const void>> itsSharedPointerStorage;
|
+
|
//! The id to be given to the next pointer
|
std::uint32_t itsCurrentPointerId;
|
|
diff --git a/include/cereal/types/memory.hpp b/include/cereal/types/memory.hpp
|
index 59e9da9b..cac1f334 100644
|
--- a/include/cereal/types/memory.hpp
|
+++ b/include/cereal/types/memory.hpp
|
@@ -263,7 +263,7 @@ namespace cereal
|
{
|
auto & ptr = wrapper.ptr;
|
|
- uint32_t id = ar.registerSharedPointer( ptr.get() );
|
+ uint32_t id = ar.registerSharedPointer( ptr );
|
ar( CEREAL_NVP_("id", id) );
|
|
if( id & detail::msb_32bit )
|
