From ff5690e3a553d9396e86e33e747178993dd9c9ed Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 6 Feb 2026 17:11:58 +0100 Subject: [PATCH] fapolicyd-1.4.3-3 - Fix 32-bit ELF dynamic section parsing Resolves: RHEL-1357 --- ...-leak-on-early-return-in-file_append.patch | 30 +++++++++++++ 0007-whitespace-fix.patch | 26 ++++++++++++ ...x-32-bit-ELF-dynamic-section-parsing.patch | 42 +++++++++++++++++++ fapolicyd.spec | 8 +++- 4 files changed, 105 insertions(+), 1 deletion(-) create mode 100644 0006-Potential-memory-leak-on-early-return-in-file_append.patch create mode 100644 0007-whitespace-fix.patch create mode 100644 0008-Fix-32-bit-ELF-dynamic-section-parsing.patch diff --git a/0006-Potential-memory-leak-on-early-return-in-file_append.patch b/0006-Potential-memory-leak-on-early-return-in-file_append.patch new file mode 100644 index 0000000..41356fc --- /dev/null +++ b/0006-Potential-memory-leak-on-early-return-in-file_append.patch @@ -0,0 +1,30 @@ +From 49d824ef1fdeca5ea5bb28ea6e68a24d21a96756 Mon Sep 17 00:00:00 2001 +From: Steve Grubb +Date: Wed, 28 Jan 2026 21:29:17 -0500 +Subject: [PATCH] Potential memory leak on early-return in file_append +Content-type: text/plain + +If add_list_load_path(path) returns failure after adding items to add_list, the function returns without calling list_empty, which can leak any accumulated entries. Call list_empty before returning an error. +--- + src/cli/file-cli.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/cli/file-cli.c b/src/cli/file-cli.c +index 7e02e939fdb0..b07d42ee070c 100644 +--- a/src/cli/file-cli.c ++++ b/src/cli/file-cli.c +@@ -130,8 +130,10 @@ int file_append(const char *path, const char *fname, bool use_filter) + + list_init(&add_list); + rc = add_list_load_path(path); +- if (rc) ++ if (rc) { ++ list_empty(&add_list); // could be partially populated by nftw + return rc; ++ } + + if (use_filter && filter_prune_list(&add_list, NULL)) { + list_empty(&add_list); +-- +2.53.0 + diff --git a/0007-whitespace-fix.patch b/0007-whitespace-fix.patch new file mode 100644 index 0000000..57dfedb --- /dev/null +++ b/0007-whitespace-fix.patch @@ -0,0 +1,26 @@ +From b91b460b943185a1585cbbfe331eac38527b64cb Mon Sep 17 00:00:00 2001 +From: Steve Grubb +Date: Wed, 28 Jan 2026 22:07:10 -0500 +Subject: [PATCH] whitespace fix +Content-type: text/plain + +--- + src/library/rpm-backend.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/library/rpm-backend.c b/src/library/rpm-backend.c +index 5b24c9589040..c4a90cd1c9f1 100644 +--- a/src/library/rpm-backend.c ++++ b/src/library/rpm-backend.c +@@ -443,7 +443,7 @@ out: + // cleaning up + struct _hash_record *item, *tmp; + HASH_ITER( hh, hashtable, item, tmp) { +- HASH_DEL( hashtable, item ); ++ HASH_DEL( hashtable, item ); + free((void*)item->key); + free((void*)item); + } +-- +2.53.0 + diff --git a/0008-Fix-32-bit-ELF-dynamic-section-parsing.patch b/0008-Fix-32-bit-ELF-dynamic-section-parsing.patch new file mode 100644 index 0000000..938baaa --- /dev/null +++ b/0008-Fix-32-bit-ELF-dynamic-section-parsing.patch @@ -0,0 +1,42 @@ +From f87d54e6eede34a6ef4b77df56ec1df9e313822d Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Fri, 6 Feb 2026 14:31:52 +0100 +Subject: [PATCH] Fix 32-bit ELF dynamic section parsing +Content-type: text/plain + +Use Elf32_Dyn instead of Elf64_Dyn when parsing PT_DYNAMIC segments in +32-bit ELF files. The incorrect type could cause a segfault on special +32 bit libraries. + +Fixes: https://issues.redhat.com/browse/RHEL-1357 + +Signed-off-by: Petr Lautrbach +--- + src/library/file.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/library/file.c b/src/library/file.c +index 802a89cc028a..2dffaaceea1e 100644 +--- a/src/library/file.c ++++ b/src/library/file.c +@@ -1485,7 +1485,7 @@ uint32_t gather_elf(int fd, off_t size) + if (ph_tbl[i].p_filesz > size) + goto err_out32; + +- Elf64_Dyn *dyn_tbl = malloc(ph_tbl[i].p_filesz); ++ Elf32_Dyn *dyn_tbl = malloc(ph_tbl[i].p_filesz); + + if((unsigned int)lseek(fd, ph_tbl[i].p_offset, + SEEK_SET) != +@@ -1494,7 +1494,7 @@ uint32_t gather_elf(int fd, off_t size) + goto err_out32; + } + +- num = ph_tbl[i].p_filesz / sizeof(Elf64_Dyn); ++ num = ph_tbl[i].p_filesz / sizeof(Elf32_Dyn); + if (num > 1000) { + free(dyn_tbl); + goto err_out32; +-- +2.53.0 + diff --git a/fapolicyd.spec b/fapolicyd.spec index 4906d27..4966b96 100644 --- a/fapolicyd.spec +++ b/fapolicyd.spec @@ -5,7 +5,7 @@ Summary: Application Whitelisting Daemon Name: fapolicyd Version: 1.4.3 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-3.0-or-later URL: https://github.com/linux-application-whitelisting/fapolicyd Source0: https://github.com/linux-application-whitelisting/fapolicyd/releases/download/v%{version}/fapolicyd-%{version}.tar.gz @@ -27,6 +27,9 @@ Patch: 0002-If-less-than-16-chars-were-read-allow-shebang-test-c.patch Patch: 0003-Fix-binary-path-of-rpm-loader.patch Patch: 0004-Map-file-with-MAP_SHARED-instead-of-MAP_PRIVATE.patch Patch: 0005-Fix-segfault-when-interrupting-fapolicyd-startup.patch +Patch: 0006-Potential-memory-leak-on-early-return-in-file_append.patch +Patch: 0007-whitespace-fix.patch +Patch: 0008-Fix-32-bit-ELF-dynamic-section-parsing.patch # Patch list end BuildRequires: gcc @@ -281,6 +284,9 @@ fi %selinux_relabel_post -s %{selinuxtype} %changelog +* Fri Feb 06 2026 Petr Lautrbach - 1.4.3-3 +- Fix 32-bit ELF dynamic section parsing + * Tue Jan 27 2026 Petr Lautrbach - 1.4.3-2 - Fix binary path of rpm-loader - Map file with MAP_SHARED instead of MAP_PRIVATE