4d55c1806b
Add patches for pmieconf/pmlogmv command injection, libpcp PDU decode OOB guards, timezone validation, pmdaroot peer credentials, and pmproxy REST CERT_REQD and logger authentication hardening. Resolves: RHEL-213756 CVE-2026-16531 Resolves: RHEL-213746 CVE-2026-16530 Resolves: RHEL-213726 CVE-2026-16529 Resolves: RHEL-213717 CVE-2026-16527 Resolves: RHEL-213692 CVE-2026-16526 Resolves: RHEL-213661 CVE-2026-16524 Co-authored-by: Cursor <cursoragent@cursor.com>
38 lines
1.6 KiB
Diff
38 lines
1.6 KiB
Diff
From 7f42013d33 Mon Sep 17 00:00:00 2001
|
|
From: Nathan Scott <nathans@redhat.com>
|
|
Subject: [PATCH] libpcp_web: add numinst overflow check in pmDiscoverDecodeMetaInDom (CWE-125/190)
|
|
|
|
Defense-in-depth for the __pmLogLoadInDom streaming path fix (commit 1).
|
|
When __pmLogLoadInDom is called with acp=NULL from the pmproxy discover
|
|
code, a garbage numinst value read from a too-small buffer could be
|
|
passed to calloc(numinst, sizeof(char *)), causing an integer overflow
|
|
in the allocation size.
|
|
|
|
Add explicit validation that numinst > 0 and does not overflow SIZE_MAX
|
|
before the calloc in pmDiscoverDecodeMetaInDom(). The primary fix
|
|
(rlen and numinst validation in __pmLogLoadInDom itself) prevents this
|
|
value from being garbage in the first place.
|
|
|
|
Reported-by: Francisco Alisson Bezerra, TIM Security Red Team
|
|
Reported-by: Lucas Gabriel Alves, TIM Security Red Team
|
|
Reported-by: Massimiliano Brolli, TIM Security Red Team
|
|
|
|
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
|
---
|
|
diff --git a/src/libpcp_web/src/discover.c b/src/libpcp_web/src/discover.c
|
|
index 13781ded6f..6c5a2e9157 100644
|
|
--- a/src/libpcp_web/src/discover.c
|
|
+++ b/src/libpcp_web/src/discover.c
|
|
@@ -2276,6 +2276,11 @@ pmDiscoverDecodeMetaInDom(__int32_t *buf, int len, int type, __pmTimestamp *tsp,
|
|
*/
|
|
char **namelist;
|
|
int i;
|
|
+ if (lid.numinst <= 0 ||
|
|
+ (size_t)lid.numinst > SIZE_MAX / sizeof(char *)) {
|
|
+ __pmFreeLogInDom(&lid);
|
|
+ return -EINVAL;
|
|
+ }
|
|
namelist = (char **)calloc(lid.numinst, sizeof(char *));
|
|
if (namelist == NULL) {
|
|
pmNoMem(__FUNCTION__, lid.numinst * sizeof(char *), PM_RECOV_ERR);
|