[svn] gcry - r1210 - trunk/src

svn author wk cvs at cvs.gnupg.org
Mon Feb 12 15:03:49 CET 2007


Author: wk
Date: 2007-02-12 15:03:48 +0100 (Mon, 12 Feb 2007)
New Revision: 1210

Modified:
   trunk/src/ChangeLog
   trunk/src/gcrypt.h.in
   trunk/src/secmem.c
Log:
* gcrypt.h.in: Include stdlib.h for the sake fo the trheading
  macros.  Suggested by Andreas Metzler.
	  
* secmem.c (ptr_into_pool_p): New.
  (_gcry_private_is_secure): Implement in terms of new function.
  (BLOCK_VALID): Removed. Replaced all users by new function.



Modified: trunk/src/ChangeLog
===================================================================
--- trunk/src/ChangeLog	2007-02-02 15:52:57 UTC (rev 1209)
+++ trunk/src/ChangeLog	2007-02-12 14:03:48 UTC (rev 1210)
@@ -1,3 +1,18 @@
+2007-02-12  Werner Koch  <wk at g10code.com>
+
+	* gcrypt.h.in: Include stdlib.h for the sake fo the trheading
+	macros.  Suggested by Andreas Metzler.
+
+	* secmem.c (ptr_into_pool_p): New.
+	(_gcry_private_is_secure): Implement in terms of new function.
+	(BLOCK_VALID): Removed.  Replaced all users by new function.
+
+2007-01-31  Werner Koch  <wk at g10code.com>
+
+	* secmem.c (_gcry_private_is_secure): Fixed severe implementation
+	flaw.  Might be the reason for some of the more obscure bugs.
+	(MB_WIPE_OUT): Use wipememory2.
+
 2006-10-23  Werner Koch  <wk at g10code.com>
 
 	* gcrypt.h.in (GCRY_THREAD_OPTION_PTHREAD_IMPL): Add some cast for

Modified: trunk/src/gcrypt.h.in
===================================================================
--- trunk/src/gcrypt.h.in	2007-02-02 15:52:57 UTC (rev 1209)
+++ trunk/src/gcrypt.h.in	2007-02-12 14:03:48 UTC (rev 1210)
@@ -22,6 +22,7 @@
 #ifndef _GCRYPT_H
 #define _GCRYPT_H
 
+#include <stdlib.h>
 #include <stdarg.h>
 #include <string.h>
 

Modified: trunk/src/secmem.c
===================================================================
--- trunk/src/secmem.c	2007-02-02 15:52:57 UTC (rev 1209)
+++ trunk/src/secmem.c	2007-02-12 14:03:48 UTC (rev 1210)
@@ -1,6 +1,6 @@
 /* secmem.c  -	memory allocation from a secure heap
  * Copyright (C) 1998, 1999, 2000, 2001, 2002,
- *               2003 Free Software Foundation, Inc.
+ *               2003, 2007 Free Software Foundation, Inc.
  *
  * This file is part of Libgcrypt.
  *
@@ -98,10 +98,21 @@
 #define ADDR_TO_BLOCK(addr) \
   (memblock_t *) ((char *) addr - BLOCK_HEAD_SIZE)
 
-/* Check wether MB is a valid block.  */
-#define BLOCK_VALID(mb) \
-  (((char *) mb - (char *) pool) < pool_size)
+/* Check whether P points into the pool.  */
+static int
+ptr_into_pool_p (const void *p)
+{
+  /* We need to convert pointers to addresses.  This is required by
+     C-99 6.5.8 to avoid undefeined behavious.  Using size_t is at
+     least only implementation defined.  See also
+     http://lists.gnupg.org/pipermail/gcrypt-devel/2007-February/001102.html
+  */
+  size_t p_addr = (size_t)p;
+  size_t pool_addr = (size_t)pool;
 
+  return p_addr >= pool_addr && p_addr <  pool_addr+pool_size;
+}
+
 /* Update the stats.  */
 static void
 stats_update (size_t add, size_t sub)
@@ -126,7 +137,7 @@
 
   mb_next = (memblock_t *) ((char *) mb + BLOCK_HEAD_SIZE + mb->size);
   
-  if (! BLOCK_VALID (mb_next))
+  if (! ptr_into_pool_p (mb_next))
     mb_next = NULL;
 
   return mb_next;
@@ -182,7 +193,7 @@
 {
   memblock_t *mb, *mb_split;
   
-  for (mb = block; BLOCK_VALID (mb); mb = mb_get_next (mb))
+  for (mb = block; ptr_into_pool_p (mb); mb = mb_get_next (mb))
     if (! (mb->flags & MB_FLAG_ACTIVE) && mb->size >= size)
       {
 	/* Found a free block.  */
@@ -205,7 +216,7 @@
 	break;
       }
 
-  if (! BLOCK_VALID (mb))
+  if (! ptr_into_pool_p (mb))
     mb = NULL;
 
   return mb;
@@ -360,7 +371,7 @@
     else
       {
 	pool = mmap (0, pool_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-	close (fd);
+        close (fd);
       }
   }
 #endif
@@ -411,7 +422,7 @@
   SECMEM_UNLOCK;
 }
 
-unsigned
+unsigned int
 _gcry_secmem_get_flags (void)
 {
   unsigned flags;
@@ -458,7 +469,7 @@
     {
       if (n < DEFAULT_POOL_SIZE)
 	n = DEFAULT_POOL_SIZE;
-      if (!pool_okay)
+      if (! pool_okay)
 	{
 	  init_pool (n);
 	  lock_pool (pool, n);
@@ -525,7 +536,7 @@
   /* This does not make much sense: probably this memory is held in the
    * cache. We do it anyway: */
 #define MB_WIPE_OUT(byte) \
-  memset ((memblock_t *) ((char *) mb + BLOCK_HEAD_SIZE), (byte), size);
+  wipememory2 ((memblock_t *) ((char *) mb + BLOCK_HEAD_SIZE), (byte), size);
 
   MB_WIPE_OUT (0xff);
   MB_WIPE_OUT (0xaa);
@@ -583,19 +594,12 @@
   return a;
 }
 
+
+/* Return true if P points into the secure memory area.  */
 int
 _gcry_private_is_secure (const void *p)
 {
-  int ret = 0;
-
-  SECMEM_LOCK;
-
-  if (pool_okay && BLOCK_VALID (ADDR_TO_BLOCK (p)))
-    ret = 1;
-
-  SECMEM_UNLOCK;
-
-  return ret;
+  return pool_okay && ptr_into_pool_p (p);
 }
 
 
@@ -624,6 +628,7 @@
   pool = NULL;
   pool_okay = 0;
   pool_size = 0;
+  not_locked = 0;
 }
 
 
@@ -644,7 +649,7 @@
   SECMEM_LOCK;
 
   for (i = 0, mb = (memblock_t *) pool;
-       BLOCK_VALID (mb);
+       ptr_into_pool_p (mb);
        mb = mb_get_next (mb), i++)
     log_info ("SECMEM: [%s] block: %i; size: %i\n",
 	      (mb->flags & MB_FLAG_ACTIVE) ? "used" : "free",




More information about the Gnupg-commits mailing list