[JIRA] (SSPCPP-959) Segfault when using ExcludedAlgorithms with a list of algs

[Jan Vilhuber (Jira)]

Jan Vilhuber ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Adcfcbfd1-c242-4cd6-8808-d0d2ce91bc7e ) *created* an issue

Shibboleth SP - C++ ( https://shibboleth.atlassian.net/browse/SSPCPP?atlOrigin=eyJpIjoiODA4OGNmZWExM2RkNDJkMDk5NmQyZmVlMWFkOTg5YTciLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/SSPCPP-959?atlOrigin=eyJpIjoiODA4OGNmZWExM2RkNDJkMDk5NmQyZmVlMWFkOTg5YTciLCJwIjoiaiJ9 ) SSPCPP-959 ( https://shibboleth.atlassian.net/browse/SSPCPP-959?atlOrigin=eyJpIjoiODA4OGNmZWExM2RkNDJkMDk5NmQyZmVlMWFkOTg5YTciLCJwIjoiaiJ9 ) Segfault when using ExcludedAlgorithms with a list of algs ( https://shibboleth.atlassian.net/browse/SSPCPP-959?atlOrigin=eyJpIjoiODA4OGNmZWExM2RkNDJkMDk5NmQyZmVlMWFkOTg5YTciLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 3.3.0 Assignee: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Components: Configuration Created: 19/Oct/22 5:51 AM Priority: Trivial Reporter: Jan Vilhuber ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Adcfcbfd1-c242-4cd6-8808-d0d2ce91bc7e )

See https://shibboleth.net/pipermail/users/2022-October/052982.html ( https://shibboleth.net/pipermail/users/2022-October/052982.html )

When using

<ExcludedAlgorithms excludeDefaults="true"/>

everything works fine.

When adding algs such as:

<ExcludedAlgorithms excludeDefaults="true">
   http://www.w3.org/2000/09/xmldsig#sha1
   http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1
   http://www.w3.org/2000/09/xmldsig#rsa-sha1
   http://www.w3.org/2000/09/xmldsig#dsa-sha1
</ExcludedAlgorithms>

shibd gets a “segmentation fault”

(gdb) n
271                     const DOMElement* alglist = XMLHelper::getLastChildElement(e, ExcludedAlgorithms);
(gdb)
272                     if (alglist) {
(gdb) p alglist
$3 = (const xercesc_3_2::DOMElement *) 0xaaaaaabf0298
(gdb) n
273                         m_excludeDefaults = XMLHelper::getAttrBool(alglist, true, excludeDefaults);
(gdb)
274                         if (alglist->hasChildNodes()) {
(gdb)
275                             algs = alglist->getFirstChild()->getNodeValue();
(gdb)
288             if (algs) {
(gdb) p algs
$4 = (const XMLCh *) 0xaaaaaaed4428 u"\n\t    http://www.w3.org/2000/09/xmldsig#sha1\n\t    http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1\n\t    http://www.w3.org/2000/09/xmldsig#rsa-sha1\n\t    http://www.w3.org/2000/09/xmldsig#dsa-sha1\n    "
(gdb) n
290                 XMLStringTokenizer tokenizer(algs);
(gdb)
291                 while (tokenizer.hasMoreTokens()) {
(gdb)
292                     token = tokenizer.nextToken();
(gdb)
293                     if (token) {
(gdb) p alglist
$5 = <optimized out>
(gdb) n
294                         if (XMLString::equals(alglist->getLocalName(), AlgorithmBlacklist) ||
(gdb) s

Thread 1 "shibd" received signal SIGSEGV, Segmentation fault.
shibsp::XMLSecurityPolicyProviderImpl::XMLSecurityPolicyProviderImpl (this=0xaaaaaaf81d60, e=0xaaaaaabe8f58, log=...)
   at impl/XMLSecurityPolicyProvider.cpp:294
294                         if (XMLString::equals(alglist->getLocalName(), AlgorithmBlacklist) ||
(gdb)

Shibd was built from scratch on ubuntu:focal

APACHE_VERSION 2.4.54

APR_VERSION=1.7.0

APR_UTIL_VERSION=1.6.1

XML_SECURITY_C_VERSION=2.0.4

XERCES_C_VERSION=3.2.3

ENV SHIB_VERSION 3.3.0

LOG4SHIB_VERSION 2.0.1

SHIBBOLETH_TOOLING_VERSION 3.2.1

( https://shibboleth.atlassian.net/browse/SSPCPP-959#add-comment?atlOrigin=eyJpIjoiODA4OGNmZWExM2RkNDJkMDk5NmQyZmVlMWFkOTg5YTciLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-959#add-comment?atlOrigin=eyJpIjoiODA4OGNmZWExM2RkNDJkMDk5NmQyZmVlMWFkOTg5YTciLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100209- sha1:5f5cf47 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221019/0aa530d3/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-498b9603-23af-4490-a30a-5620c172e797
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221019/0aa530d3/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-097088ed-12cc-4361-8430-4aa4e5ab4426
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221019/0aa530d3/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-85b3656a-12ab-4787-b9fe-78eacc250916
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221019/0aa530d3/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-f3078ab3-ce6d-46a4-9c40-5ee38777661e
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221019/0aa530d3/attachment-0007.png>