Patched memo vulnerability

[quasar098]

quick fix for #22

I felt bad for solving the challenge on the Imaginary ctf but not disclosing the vulnerability, so I am making this pull request

it patches the case where the memo is not in order.

import pickle, base64

pkl = b''.join([
    pickle.UNICODE + b'os\n',
    pickle.PUT + b'2\n',
    pickle.POP,
    pickle.UNICODE + b'system\n',
    pickle.PUT + b'3\n',
    pickle.POP,
    pickle.UNICODE + b'torch\n',
    pickle.PUT + b'0\n',
    pickle.POP,
    pickle.UNICODE + b'LongStorage\n',
    pickle.PUT + b'1\n',
    pickle.POP,

    pickle.GET + b'2\n',
    pickle.GET + b'3\n',
    pickle.STACK_GLOBAL,

    pickle.MARK,
    pickle.UNICODE + b'cat flag.txt\n',
    pickle.TUPLE,

    pickle.REDUCE
]) + b'.'
print(base64.b64encode(pkl).decode())

perhaps another idea is that pickles could be checked to make sure the memo is in order (pickler always does memo from 0 counting up from what i can see, so any other order is suspicious)

[quasar098]

the test appears to have failed but I do not think it was my code that did it

[mmaitre314]

First, thanks for the contribution -- I thought I would make progress on that issue but didn't. Second, the test failure looks pretty close of the code changed. It seems that memo position is accessed but does not exist (KeyError: 1 accessing memo[int(ops[n - offset][1])]). Probably a bit more fix needed. I'll try to debug (time permitting).

[mmaitre314]

Should the fix apply to PUT, BINPUT, LONG_BINPUT but not MEMOIZE? It looks like the latter has no input argument and puts the memo at the end: https://github.com/python/cpython/blob/1583c40be938d2caf363c126976bc8757df90b13/Lib/pickletools.py#L1864
On the other hand, the picketools doc mentions the other three take the memo location as input parameter and there the fix looks valid: https://github.com/python/cpython/blob/1583c40be938d2caf363c126976bc8757df90b13/Lib/pickletools.py#L1827

[quasar098]

oops, i forgot about MEMOIZE i was just testing with the proof of concept vulnerability that i found on the imaginary ctf website, i will check that out

[mmaitre314]

Cool. The fix looks simpler than I expected. I can add the MEMOIZE case and some tests. Thanks for your help!

[quasar098]

alright