commit 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Tue Jan 21 16:11:06 2025 -0500

    Fix underallocation of abort_msg_s struct (CVE-2025-0395)
    
    Include the space needed to store the length of the message itself, in
    addition to the message string.  This resolves BZ #32582.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

diff -Nrup a/assert/assert.c b/assert/assert.c
--- a/assert/assert.c	2025-01-29 14:45:37.480532858 -0500
+++ b/assert/assert.c	2025-01-29 14:54:03.824306418 -0500
@@ -18,6 +18,7 @@
 #include <assert.h>
 #include <atomic.h>
 #include <ldsodefs.h>
+#include <libc-pointer-arith.h>
 #include <libintl.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -66,7 +67,8 @@ __assert_fail_base (const char *fmt, con
       (void) __fxprintf (NULL, "%s", str);
       (void) fflush (stderr);
 
-      total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1);
+      total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1,
+			GLRO(dl_pagesize));
       struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE,
 					MAP_ANON | MAP_PRIVATE, -1, 0);
       if (__glibc_likely (buf != MAP_FAILED))
diff -Nrup a/sysdeps/posix/libc_fatal.c b/sysdeps/posix/libc_fatal.c
--- a/sysdeps/posix/libc_fatal.c	2025-01-29 14:45:36.603528055 -0500
+++ b/sysdeps/posix/libc_fatal.c	2025-01-29 15:57:20.910535347 -0500
@@ -20,6 +20,7 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <ldsodefs.h>
+#include <libc-pointer-arith.h>
 #include <paths.h>
 #include <stdarg.h>
 #include <stdbool.h>
@@ -123,7 +124,8 @@ __libc_message (const char *fmt, ...)
 
       WRITEV_FOR_FATAL (fd, iov, nlist, total);
 
-      total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1);
+      total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1,
+			GLRO(dl_pagesize));
       struct abort_msg_s *buf = __mmap (NULL, total,
 					PROT_READ | PROT_WRITE,
 					MAP_ANON | MAP_PRIVATE, -1, 0);