[pkg-uWSGI-devel] Fwd: Possible uWSGI security vulnerability

[Alexandre Rossi]

Hi,

> core/utils.c function check_hex is clearly wrong, and allows non-hex
> characters through.

Please provide an example, I fail to see something wrong in check_hex().

> I don't have enough knowledge to research the security implications,
> but it doesn't look good. It is also kind of public, as at least one
> unrelated PR fixes it #2766 (might have been autofixed by some coding
> tool?).

Again, I fail to see something fixed in the following patch, it only negates
the AND'ed conditions.

--- a/core/utils.c
+++ b/core/utils.c
@@ -31,7 +31,7 @@ uint64_t uwsgi_swap64(uint64_t x) {
 int check_hex(char *str, int len) {
 	int i;
 	for (i = 0; i < len; i++) {
-		if ((str[i] < '0' && str[i] > '9') && (str[i] < 'a' && str[i] > 'f') && (str[i] < 'A' && str[i] > 'F')
+		if (!(str[i] >= '0' && str[i] <= '9') && !(str[i] >= 'a' && str[i] <= 'f') && !(str[i] >= 'A' && str[i] <= 'F')
 			) {
 			return 0;
 		}

Thanks,

Alex