63 lines
2.2 KiB
Diff
63 lines
2.2 KiB
Diff
commit 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578
|
|
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
|
|
Date: Tue Jan 21 16:11:06 2025 -0500
|
|
|
|
Fix underallocation of abort_msg_s struct (CVE-2025-0395)
|
|
|
|
Include the space needed to store the length of the message itself, in
|
|
addition to the message string. This resolves BZ #32582.
|
|
|
|
Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
|
|
Reviewed: Adhemerval Zanella <adhemerval.zanella@linaro.org>
|
|
|
|
Conflicts:
|
|
sysdeps/posix/libc_fatal.c: Adjust for skipped upstream commit:
|
|
cca9684f2d7a74fc0b28bfb1859955e0e28d7b4b
|
|
(stdio: Clean up __libc_message after unconditional abort)
|
|
|
|
diff --git a/assert/assert.c b/assert/assert.c
|
|
index 8ed691bd323c876a..f81d751cdab5ff92 100644
|
|
--- a/assert/assert.c
|
|
+++ b/assert/assert.c
|
|
@@ -18,6 +18,7 @@
|
|
#include <assert.h>
|
|
#include <atomic.h>
|
|
#include <ldsodefs.h>
|
|
+#include <libc-pointer-arith.h>
|
|
#include <libintl.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
@@ -64,7 +65,8 @@ __assert_fail_base (const char *fmt, const char *assertion, const char *file,
|
|
(void) __fxprintf (NULL, "%s", str);
|
|
(void) fflush (stderr);
|
|
|
|
- total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1);
|
|
+ total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1,
|
|
+ GLRO(dl_pagesize));
|
|
struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE,
|
|
MAP_ANON | MAP_PRIVATE, -1, 0);
|
|
if (__glibc_likely (buf != MAP_FAILED))
|
|
diff --git a/sysdeps/posix/libc_fatal.c b/sysdeps/posix/libc_fatal.c
|
|
index 89a20080e16558b5..89d5782a44e251a8 100644
|
|
--- a/sysdeps/posix/libc_fatal.c
|
|
+++ b/sysdeps/posix/libc_fatal.c
|
|
@@ -20,6 +20,7 @@
|
|
#include <errno.h>
|
|
#include <fcntl.h>
|
|
#include <ldsodefs.h>
|
|
+#include <libc-pointer-arith.h>
|
|
#include <paths.h>
|
|
#include <stdarg.h>
|
|
#include <stdbool.h>
|
|
@@ -147,8 +148,8 @@ __libc_message (enum __libc_message_action action, const char *fmt, ...)
|
|
|
|
if ((action & do_abort))
|
|
{
|
|
- total = ((total + 1 + GLRO(dl_pagesize) - 1)
|
|
- & ~(GLRO(dl_pagesize) - 1));
|
|
+ total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1,
|
|
+ GLRO(dl_pagesize));
|
|
struct abort_msg_s *buf = __mmap (NULL, total,
|
|
PROT_READ | PROT_WRITE,
|
|
MAP_ANON | MAP_PRIVATE, -1, 0);
|