From a253f55a95d036bd57b0636f6dbad61705aee938 Mon Sep 17 00:00:00 2001
From: Thomas Vermeilh <ory@oryctero.pe>
Date: Thu, 8 Aug 2024 15:13:52 +0200
Subject: [PATCH] fix stack overflow on recursive export trie

When the export trie is malformed and is recursive, this Exported::parse()
will stack overflow when trying to parse it.

Detect this condition and return an error instead. This is implemented by
remembering the list of parent nodes that we visited in the trie, and erroring
if we ever try to visit the same node a second time.

I initially tried to implement it by ensuring that the Cursor always makes
forward progress when parsing the trie, but some valid binaries, e.g. /usr/bin/smbd
layout their trie in a way that requires to sometime jump backwards to get the
child nodes.
---
 src/errors.rs |  2 ++
 src/export.rs | 19 ++++++++++++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/errors.rs b/src/errors.rs
index fe2d9ce..c1ea8df 100644
--- a/src/errors.rs
+++ b/src/errors.rs
@@ -33,6 +33,8 @@ pub enum Error {
     NumberOverflow,
     #[error("buffer overflowing, {0}.")]
     BufferOverflow(usize),
+    #[error("recursive export trie at offset {0}.")]
+    RecursiveExportTrie(u64),
 }
 
 pub type Result<T> = ::std::result::Result<T, Error>;
diff --git a/src/export.rs b/src/export.rs
index 64271bc..68adb06 100644
--- a/src/export.rs
+++ b/src/export.rs
@@ -32,6 +32,18 @@ impl Exported {
     where
         T: AsRef<[u8]>,
     {
+        Self::parse_inner(cur, &[])
+    }
+
+    fn parse_inner<T>(cur: &mut Cursor<T>, visited_offsets: &[u64]) -> Result<Exported>
+    where
+        T: AsRef<[u8]>,
+    {
+        // add this node to the list of visited offsets that will be passed
+        // to child nodes
+        let mut visited_offsets = visited_offsets.to_owned();
+        visited_offsets.push(cur.position());
+
         let terminal_size = cur.read_uleb128()?;
 
         let symbol = if terminal_size != 0 {
@@ -88,12 +100,17 @@ impl Exported {
                 if offset > payload.len() {
                     return Err(BufferOverflow(offset));
                 }
+                // prevent infinite recursions if the trie is malformed by
+                // checking we don't revisit any of our parents
+                if visited_offsets.contains(&(offset as u64)) {
+                    return Err(RecursiveExportTrie(offset as u64));
+                }
 
                 let mut cur = Cursor::new(payload);
 
                 cur.set_position(offset as u64);
 
-                Ok((name, Exported::parse(&mut cur)?))
+                Ok((name, Exported::parse_inner(&mut cur, &visited_offsets)?))
             })
             .collect::<Result<Vec<(String, Exported)>>>()?;