diff options
Diffstat (limited to 'source/l/glibc/patches/glibc.CVE-2021-3998.patch')
| -rw-r--r-- | source/l/glibc/patches/glibc.CVE-2021-3998.patch | 123 |
1 files changed, 0 insertions, 123 deletions
diff --git a/source/l/glibc/patches/glibc.CVE-2021-3998.patch b/source/l/glibc/patches/glibc.CVE-2021-3998.patch deleted file mode 100644 index 45602d050..000000000 --- a/source/l/glibc/patches/glibc.CVE-2021-3998.patch +++ /dev/null @@ -1,123 +0,0 @@ -From f7a79879c0b2bef0dadd6caaaeeb0d26423e04e5 Mon Sep 17 00:00:00 2001 -From: Siddhesh Poyarekar <siddhesh@sourceware.org> -Date: Thu, 13 Jan 2022 11:28:36 +0530 -Subject: [PATCH] realpath: Set errno to ENAMETOOLONG for result larger than - PATH_MAX [BZ #28770] - -realpath returns an allocated string when the result exceeds PATH_MAX, -which is unexpected when its second argument is not NULL. This results -in the second argument (resolved) being uninitialized and also results -in a memory leak since the caller expects resolved to be the same as the -returned value. - -Return NULL and set errno to ENAMETOOLONG if the result exceeds -PATH_MAX. This fixes [BZ #28770], which is CVE-2021-3998. - -Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> -Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> -(cherry picked from commit ee8d5e33adb284601c00c94687bc907e10aec9bb) ---- - NEWS | 4 +++ - stdlib/Makefile | 1 + - stdlib/canonicalize.c | 12 +++++++-- - stdlib/tst-realpath-toolong.c | 49 +++++++++++++++++++++++++++++++++++ - 4 files changed, 64 insertions(+), 2 deletions(-) - create mode 100644 stdlib/tst-realpath-toolong.c - ---- ./NEWS.orig 2021-02-01 11:15:33.000000000 -0600 -+++ ./NEWS 2022-01-24 13:32:24.268678228 -0600 -@@ -118,6 +118,10 @@ - CVE-2019-25013: A buffer overflow has been fixed in the iconv function when - invoked with EUC-KR input containing invalid multibyte input sequences. - -+ CVE-2021-3998: Passing a path longer than PATH_MAX to the realpath -+ function could result in a memory leak and potential access of -+ uninitialized memory. Reported by Qualys. -+ - The following bugs are resolved with this release: - - [10635] libc: realpath portability patches ---- ./stdlib/canonicalize.c.orig 2021-02-01 11:15:33.000000000 -0600 -+++ ./stdlib/canonicalize.c 2022-01-24 13:32:24.268678228 -0600 -@@ -400,8 +400,16 @@ - - error: - *dest++ = '\0'; -- if (resolved != NULL && dest - rname <= get_path_max ()) -- rname = strcpy (resolved, rname); -+ if (resolved != NULL) -+ { -+ if (dest - rname <= get_path_max ()) -+ rname = strcpy (resolved, rname); -+ else -+ { -+ failed = true; -+ __set_errno (ENAMETOOLONG); -+ } -+ } - - error_nomem: - scratch_buffer_free (&extra_buffer); ---- ./stdlib/Makefile.orig 2022-01-24 13:32:24.268678228 -0600 -+++ ./stdlib/Makefile 2022-01-24 13:32:59.968676254 -0600 -@@ -86,7 +86,7 @@ - tst-makecontext-align test-bz22786 tst-strtod-nan-sign \ - tst-swapcontext1 tst-setcontext4 tst-setcontext5 \ - tst-setcontext6 tst-setcontext7 tst-setcontext8 \ -- tst-setcontext9 tst-bz20544 tst-canon-bz26341 -+ tst-setcontext9 tst-bz20544 tst-canon-bz26341 tst-realpath-toolong - - tests-internal := tst-strtod1i tst-strtod3 tst-strtod4 tst-strtod5i \ - tst-tls-atexit tst-tls-atexit-nodelete ---- ./stdlib/tst-realpath-toolong.c.orig 2022-01-24 13:32:24.268678228 -0600 -+++ ./stdlib/tst-realpath-toolong.c 2022-01-24 13:32:24.268678228 -0600 -@@ -0,0 +1,49 @@ -+/* Verify that realpath returns NULL with ENAMETOOLONG if the result exceeds -+ NAME_MAX. -+ Copyright The GNU Toolchain Authors. -+ This file is part of the GNU C Library. -+ -+ The GNU C Library is free software; you can redistribute it and/or -+ modify it under the terms of the GNU Lesser General Public -+ License as published by the Free Software Foundation; either -+ version 2.1 of the License, or (at your option) any later version. -+ -+ The GNU C Library is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ Lesser General Public License for more details. -+ -+ You should have received a copy of the GNU Lesser General Public -+ License along with the GNU C Library; if not, see -+ <https://www.gnu.org/licenses/>. */ -+ -+#include <errno.h> -+#include <limits.h> -+#include <stdlib.h> -+#include <string.h> -+#include <unistd.h> -+#include <support/check.h> -+#include <support/temp_file.h> -+#include <sys/types.h> -+#include <sys/stat.h> -+ -+#define BASENAME "tst-realpath-toolong." -+ -+int -+do_test (void) -+{ -+ char *base = support_create_and_chdir_toolong_temp_directory (BASENAME); -+ -+ char buf[PATH_MAX + 1]; -+ const char *res = realpath (".", buf); -+ -+ /* canonicalize.c states that if the real path is >= PATH_MAX, then -+ realpath returns NULL and sets ENAMETOOLONG. */ -+ TEST_VERIFY (res == NULL); -+ TEST_VERIFY (errno == ENAMETOOLONG); -+ -+ free (base); -+ return 0; -+} -+ -+#include <support/test-driver.c> |