unofficial mirror of notmuch@notmuchmail.org
 help / color / mirror / code / Atom feed
* possible infinite recursion in notmuch-cli
@ 2013-10-10 22:51 Daniel Kahn Gillmor
  2021-12-26 13:05 ` David Bremner
  0 siblings, 1 reply; 2+ messages in thread
From: Daniel Kahn Gillmor @ 2013-10-10 22:51 UTC (permalink / raw)
  To: notmuch mailing list

[-- Attachment #1: Type: text/plain, Size: 1892 bytes --]

Hi notmuch folks--

On oss-security recently, there was a discussion about recursive
compression and the ability to create infinite loops.

 id:20131010013106.GA29693@openwall.com

After some discussion with amdragon on IRC, i believe that this is only
relevant to notmuch when actively decrypting a message -- OpenPGP's
ability to embed compression makes it possible to write a PGP/MIME
message that is a quine: that is, when decompressed, it would expand to
itself, which would send our parser into an infinite loop.

Since we're not decrypting during indexing, only notmuch-show and
notmuch-reply are probably affected by this problem. (but if someone
implements indexing of encrypted messages, then we'd have to worry about
this in the indexer as well)

The simple and generalized solution would be to limit the recursive
depth of our walk of the MIME tree; probably a large limit of something
like 30 or 50 would not trigger any real-world problems, and would halt
a runaway recursion well before most modern machines ran out of
resources.

A more targeted fix might be to just limit the number of recursive
decryptions that happen, since the MIME spec does not appear to be
capable of permitting other parts to provide both compression and
nesting, which is the root of the problem.  However, it's possible that
our MIME parsing ends up being more permissive than the specs, and is
willing to try to interpret (for example) a gzip-compressed multipart/*
or message/* part.  

So the simple/generalized solution is probably the right way to go.

Sorry i don't have time to implement the fix myself right now, but i
wanted to make sure the active coders in the project are aware of the
issue.

Regards,

      --dkg

references:

 http://mumble.net/~campbell/blag.txt (see 2013-10-08)
 http://www.openwall.com/lists/oss-security/2013/10/10/2

[-- Attachment #2: Type: application/pgp-signature, Size: 965 bytes --]

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: possible infinite recursion in notmuch-cli
  2013-10-10 22:51 possible infinite recursion in notmuch-cli Daniel Kahn Gillmor
@ 2021-12-26 13:05 ` David Bremner
  0 siblings, 0 replies; 2+ messages in thread
From: David Bremner @ 2021-12-26 13:05 UTC (permalink / raw)
  To: Daniel Kahn Gillmor, notmuch mailing list

Daniel Kahn Gillmor <dkg@fifthhorseman.net> writes:


> After some discussion with amdragon on IRC, i believe that this is only
> relevant to notmuch when actively decrypting a message -- OpenPGP's
> ability to embed compression makes it possible to write a PGP/MIME
> message that is a quine: that is, when decompressed, it would expand to
> itself, which would send our parser into an infinite loop.
>
> Since we're not decrypting during indexing, only notmuch-show and
> notmuch-reply are probably affected by this problem. (but if someone
> implements indexing of encrypted messages, then we'd have to worry about
> this in the indexer as well)

This is indeed our current situation.

> The simple and generalized solution would be to limit the recursive
> depth of our walk of the MIME tree; probably a large limit of something
> like 30 or 50 would not trigger any real-world problems, and would halt
> a runaway recursion well before most modern machines ran out of
> resources.

So do I understand correctly that to test this proposed fix, we would
not need to generate a MIME-quine (which sounds challenging) but just a
very deep MIME tree?

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-12-26 13:06 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-10-10 22:51 possible infinite recursion in notmuch-cli Daniel Kahn Gillmor
2021-12-26 13:05 ` David Bremner

Code repositories for project(s) associated with this inbox:

	notmuch.git.git (no URL configured)

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).