rgw: check for aws4 headers size where needed

Fixes: #15940
Signed-off-by: Yehuda Sadeh <yehuda@redhat.com>
(cherry picked from commit 493cc5d1241693f3ea52f4d7f3a194d9e0ec1905)

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index dc4e9708efa1565f13d0b5dcba07bf52c2b17dca..42dc3eba11afbe6e082551bc06567d4aa224cda9 100644 (file)
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -3277,8 +3277,15 @@ int RGW_Auth_S3::authorize_v4(RGWRados *store, struct req_state *s)
 
     using_qs = false;
     s->aws4_auth->credential = s->http_auth;
+#define AWS4_HMAC_SHA256_STR "AWS4-HMAC-SHA256"
+#define CREDENTIALS_PREFIX_LEN (sizeof(AWS4_HMAC_SHA256_STR) - 1)
+    ssize_t min_len = CREDENTIALS_PREFIX_LEN + 1;
+    if (s->aws4_auth->credential.length() < min_len) {
+      ldout(store->ctx(), 10) << "credentials string is too short" << dendl;
+      return -EINVAL;
+    }
 
-    s->aws4_auth->credential = s->aws4_auth->credential.substr(17, s->aws4_auth->credential.length());
+    s->aws4_auth->credential = s->aws4_auth->credential.substr(min_len, s->aws4_auth->credential.length());
 
     pos = s->aws4_auth->credential.find("Credential");
     if (pos == std::string::npos) {
@@ -3297,7 +3304,7 @@ int RGW_Auth_S3::authorize_v4(RGWRados *store, struct req_state *s)
 
     s->aws4_auth->signedheaders = s->http_auth;
 
-    s->aws4_auth->signedheaders = s->aws4_auth->signedheaders.substr(17, s->aws4_auth->signedheaders.length());
+    s->aws4_auth->signedheaders = s->aws4_auth->signedheaders.substr(min_len, s->aws4_auth->signedheaders.length());
 
     pos = s->aws4_auth->signedheaders.find("SignedHeaders");
     if (pos == std::string::npos) {
@@ -3327,7 +3334,12 @@ int RGW_Auth_S3::authorize_v4(RGWRados *store, struct req_state *s)
 
     s->aws4_auth->signature = s->http_auth;
 
-    s->aws4_auth->signature = s->aws4_auth->signature.substr(17, s->aws4_auth->signature.length());
+    if (s->aws4_auth->signature.size() < min_len) {
+      ldout(store->ctx(), 10) << "signature string is too short" << dendl;
+      return -EINVAL;
+    }
+
+    s->aws4_auth->signature = s->aws4_auth->signature.substr(min_len, s->aws4_auth->signature.length());
 
     pos = s->aws4_auth->signature.find("Signature");
     if (pos == std::string::npos) {