search

trusteddomainproject / OpenARC

Open source ARC implementation
BSD 2-Clause "Simplified" License
135 stars 45 forks source link

OpenARC crashes when only a single c= canonicalization is present in the ARC Message Signature #140

Closed supermistag closed 3 years ago

supermistag commented 3 years ago

Summary

If the ARC-Seal c= field only contains one value, arc_parse_canon_t passes a NULL to arc_name_to_code, causing a crash in strcasecmp

Detail

RFC-6376 (DKIM) (section 3.5) : If only one algorithm is named, that algorithm is used for the header and "simple" is used for the body. For example, "c=relaxed" is treated the same as "c=relaxed/simple".

RFC-8617 (ARC) states the canonicalization uses RFC-6376 definitions for fields. If further states that only "relaxed" canonicalization is allowed, so if missing, set to "relaxed" instead

This means that a value of c=relaxed is permitted in the ARC Message Signature.

Sample data:

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed; d=xxxx.com; s=securemail; t=1615885933; bh=9DhmaIwA6aWZhCUaFaOFDUoIZxR3

The bug

There is no check for NULL (no token found) on the second call to strtok_r in arc_parse_canon_t, causing a crash when the NULL token is passed to arc_name_to_code

supermistag commented 3 years ago

Apologies, I see this fix is in the develop branch already by #83