import UBI coreutils-8.32-41.el9_8
This commit is contained in:
AlmaLinux RelEng Bot
parent
acae8fb454
commit
ea1e5a9ff8
107
SOURCES/coreutils-CVE-2025-5278.patch
Normal file
107
SOURCES/coreutils-CVE-2025-5278.patch
Normal file
@ -0,0 +1,107 @@
|
||||
From ec1b9be71e9c033e48c40cac58d784a94d6d3179 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?P=C3=A1draig=20Brady?= <P@draigBrady.com>
|
||||
Date: Tue, 20 May 2025 16:03:44 +0100
|
||||
Subject: [PATCH] sort: fix buffer under-read (CWE-127)
|
||||
|
||||
* src/sort.c (begfield): Check pointer adjustment
|
||||
to avoid Out-of-range pointer offset (CWE-823).
|
||||
(limfield): Likewise.
|
||||
* tests/sort/sort-field-limit.sh: Add a new test,
|
||||
which triggers with ASAN or Valgrind.
|
||||
* tests/local.mk: Reference the new test.
|
||||
Fixes https://bugs.gnu.org/78507
|
||||
|
||||
(cherry picked from commit 8c9602e3a145e9596dc1a63c6ed67865814b6633)
|
||||
---
|
||||
src/sort.c | 12 ++++++++++--
|
||||
tests/local.mk | 1 +
|
||||
tests/sort/sort-field-limit.sh | 35 ++++++++++++++++++++++++++++++++++
|
||||
3 files changed, 46 insertions(+), 2 deletions(-)
|
||||
create mode 100755 tests/sort/sort-field-limit.sh
|
||||
|
||||
diff --git a/src/sort.c b/src/sort.c
|
||||
index 329ed45dc..a78dbf713 100644
|
||||
--- a/src/sort.c
|
||||
+++ b/src/sort.c
|
||||
@@ -1643,7 +1643,11 @@ begfield (struct line const *line, struct keyfield const *key)
|
||||
++ptr;
|
||||
|
||||
/* Advance PTR by SCHAR (if possible), but no further than LIM. */
|
||||
- ptr = MIN (lim, ptr + schar);
|
||||
+ size_t remaining_bytes = lim - ptr;
|
||||
+ if (schar < remaining_bytes)
|
||||
+ ptr += schar;
|
||||
+ else
|
||||
+ ptr = lim;
|
||||
|
||||
return ptr;
|
||||
}
|
||||
@@ -1744,7 +1748,11 @@ limfield (struct line const *line, struct keyfield const *key)
|
||||
++ptr;
|
||||
|
||||
/* Advance PTR by ECHAR (if possible), but no further than LIM. */
|
||||
- ptr = MIN (lim, ptr + echar);
|
||||
+ size_t remaining_bytes = lim - ptr;
|
||||
+ if (echar < remaining_bytes)
|
||||
+ ptr += echar;
|
||||
+ else
|
||||
+ ptr = lim;
|
||||
}
|
||||
|
||||
return ptr;
|
||||
diff --git a/tests/local.mk b/tests/local.mk
|
||||
index a41790799..69cf80f23 100644
|
||||
--- a/tests/local.mk
|
||||
+++ b/tests/local.mk
|
||||
@@ -369,6 +369,7 @@ all_tests = \
|
||||
tests/misc/sort-debug-keys.sh \
|
||||
tests/misc/sort-debug-warn.sh \
|
||||
tests/misc/sort-discrim.sh \
|
||||
+ tests/sort/sort-field-limit.sh \
|
||||
tests/misc/sort-files0-from.pl \
|
||||
tests/misc/sort-float.sh \
|
||||
tests/misc/sort-h-thousands-sep.sh \
|
||||
diff --git a/tests/sort/sort-field-limit.sh b/tests/sort/sort-field-limit.sh
|
||||
new file mode 100755
|
||||
index 000000000..52d8e1d17
|
||||
--- /dev/null
|
||||
+++ b/tests/sort/sort-field-limit.sh
|
||||
@@ -0,0 +1,35 @@
|
||||
+#!/bin/sh
|
||||
+# From 7.2-9.7, this would trigger an out of bounds mem read
|
||||
+
|
||||
+# Copyright (C) 2025 Free Software Foundation, Inc.
|
||||
+
|
||||
+# This program is free software: you can redistribute it and/or modify
|
||||
+# it under the terms of the GNU General Public License as published by
|
||||
+# the Free Software Foundation, either version 3 of the License, or
|
||||
+# (at your option) any later version.
|
||||
+
|
||||
+# This program is distributed in the hope that it will be useful,
|
||||
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
+# GNU General Public License for more details.
|
||||
+
|
||||
+# You should have received a copy of the GNU General Public License
|
||||
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
+
|
||||
+. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
|
||||
+print_ver_ sort
|
||||
+getlimits_
|
||||
+
|
||||
+# This issue triggers with valgrind or ASAN
|
||||
+valgrind --error-exitcode=1 sort --version 2>/dev/null &&
|
||||
+ VALGRIND='valgrind --error-exitcode=1'
|
||||
+
|
||||
+{ printf '%s\n' aa bb; } > in || framework_failure_
|
||||
+
|
||||
+_POSIX2_VERSION=200809 $VALGRIND sort +0.${SIZE_MAX}R in > out || fail=1
|
||||
+compare in out || fail=1
|
||||
+
|
||||
+_POSIX2_VERSION=200809 $VALGRIND sort +1 -1.${SIZE_MAX}R in > out || fail=1
|
||||
+compare in out || fail=1
|
||||
+
|
||||
+Exit $fail
|
||||
--
|
||||
2.54.0
|
||||
|
||||
@ -2933,7 +2933,7 @@ index 568944e..192f776 100644
|
||||
--- a/tests/local.mk
|
||||
+++ b/tests/local.mk
|
||||
@@ -369,6 +369,8 @@ all_tests = \
|
||||
tests/misc/sort-discrim.sh \
|
||||
tests/sort/sort-field-limit.sh \
|
||||
tests/misc/sort-files0-from.pl \
|
||||
tests/misc/sort-float.sh \
|
||||
+ tests/misc/sort-mb-tests.sh \
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
Summary: A set of basic GNU tools commonly used in shell scripts
|
||||
Name: coreutils
|
||||
Version: 8.32
|
||||
Release: 40%{?dist}
|
||||
Release: 41%{?dist}
|
||||
License: GPLv3+
|
||||
Url: https://www.gnu.org/software/coreutils/
|
||||
Source0: https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz
|
||||
@ -84,6 +84,10 @@ Patch23: coreutils-nproc-affinity-2.patch
|
||||
# fix sort fdlimit test failures on s390x with /dev/z90crypt (RHEL-60290)
|
||||
Patch24: coreutils-8.32-s390x-fdlimit.patch
|
||||
|
||||
# CVE-2025-5278 - Heap Buffer Under-Read in sort via Key Specification
|
||||
# upstream commit: https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633
|
||||
Patch25: coreutils-CVE-2025-5278.patch
|
||||
|
||||
# disable the test-lock gnulib test prone to deadlock
|
||||
Patch100: coreutils-8.26-test-lock.patch
|
||||
|
||||
@ -333,6 +337,9 @@ rm -f $RPM_BUILD_ROOT%{_infodir}/dir
|
||||
%license COPYING
|
||||
|
||||
%changelog
|
||||
* Mon Jun 01 2026 Lukáš Zaoral <lzaoral@redhat.com> - 9.5-8
|
||||
- CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification (RHEL-180331)
|
||||
|
||||
* Thu Jan 15 2026 Lukáš Zaoral <lzaoral@redhat.com> - 8.32-40
|
||||
- fold: fix processing of malformed UTF-8 sequences (RHEL-136086)
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user