import libuv-1.38.0-2.el8
This commit is contained in:
parent
dc92e913a3
commit
634a7e51b4
48
SOURCES/libuv-unix-don-t-use-_POSIX_PATH_MAX.patch
Normal file
48
SOURCES/libuv-unix-don-t-use-_POSIX_PATH_MAX.patch
Normal file
@ -0,0 +1,48 @@
|
||||
Upstream patch from https://github.com/libuv/libuv/pull/2966
|
||||
to address https://bugzilla.redhat.com/show_bug.cgi?id=1879330
|
||||
Resolves: #CVE-2020-8252
|
||||
|
||||
From 0e6e8620496dff0eb285589ef1e37a7f407f3ddd Mon Sep 17 00:00:00 2001
|
||||
From: Ben Noordhuis <info@bnoordhuis.nl>
|
||||
Date: Mon, 24 Aug 2020 11:42:27 +0200
|
||||
Subject: unix: don't use _POSIX_PATH_MAX
|
||||
|
||||
Libuv was using _POSIX_PATH_MAX wrong. Bug introduced in commit b56d279b
|
||||
("unix: do not require PATH_MAX to be defined") from September 2018.
|
||||
|
||||
_POSIX_PATH_MAX is the minimum max path size guaranteed by POSIX, not
|
||||
the actual max path size of the system libuv runs on. _POSIX_PATH_MAX
|
||||
is always 256, the real max is often much bigger.
|
||||
|
||||
This commit fixes buffer overruns when processing very long paths in
|
||||
uv_fs_readlink() and uv_fs_realpath() because libuv was not allocating
|
||||
enough memory to store the result.
|
||||
|
||||
Fixes: https://github.com/libuv/libuv/issues/2965
|
||||
PR-URL: https://github.com/libuv/libuv/pull/2966
|
||||
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
|
||||
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
|
||||
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
|
||||
Reviewed-By: Jameson Nash <vtjnash@gmail.com>
|
||||
---
|
||||
src/unix/internal.h | 4 +---
|
||||
1 file changed, 1 insertion(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/unix/internal.h b/src/unix/internal.h
|
||||
index 30711673..9d3c2297 100644
|
||||
--- a/src/unix/internal.h
|
||||
+++ b/src/unix/internal.h
|
||||
@@ -62,9 +62,7 @@
|
||||
# include <AvailabilityMacros.h>
|
||||
#endif
|
||||
|
||||
-#if defined(_POSIX_PATH_MAX)
|
||||
-# define UV__PATH_MAX _POSIX_PATH_MAX
|
||||
-#elif defined(PATH_MAX)
|
||||
+#if defined(PATH_MAX)
|
||||
# define UV__PATH_MAX PATH_MAX
|
||||
#else
|
||||
# define UV__PATH_MAX 8192
|
||||
--
|
||||
2.26.2
|
||||
|
@ -6,7 +6,7 @@
|
||||
Name: libuv
|
||||
Epoch: 1
|
||||
Version: 1.38.0
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
Summary: Platform layer for node.js
|
||||
|
||||
# the licensing breakdown is described in detail in the LICENSE file
|
||||
@ -25,6 +25,7 @@ BuildRequires: gcc
|
||||
# -- Patches -- #
|
||||
Patch1: 0001-Disable-failing-network-tests.patch
|
||||
%endif
|
||||
Patch2: libuv-unix-don-t-use-_POSIX_PATH_MAX.patch
|
||||
|
||||
%description
|
||||
libuv is a new platform layer for Node. Its purpose is to abstract IOCP on
|
||||
@ -88,6 +89,11 @@ make check
|
||||
%{_libdir}/%{name}.a
|
||||
|
||||
%changelog
|
||||
* Wed Sep 23 2020 Honza Horak <hhorak@redhat.com> - 1:1.38.0-2
|
||||
- Fix max path size by not using _POSIX_PATH_MAX
|
||||
Resolves: #1879330
|
||||
Fixes: CVE-2020-8252
|
||||
|
||||
* Tue Jun 09 2020 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:1.38.0-1
|
||||
- Update, disable failing tests
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user