d6aade7578
Backport applicable private-pcp security fixes to PCP 6.3.7 for RHEL 9.9. CVE-2026-16531 is not applicable because the pmproxy logger servlet is absent in this release. Resolves: RHEL-213747 CVE-2026-16530 Resolves: RHEL-213736 CVE-2026-16529 Resolves: RHEL-213711 CVE-2026-16527 Resolves: RHEL-213687 CVE-2026-16526 Resolves: RHEL-213658 CVE-2026-16524 Co-authored-by: Cursor <cursoragent@cursor.com>
39 lines
1.6 KiB
Diff
39 lines
1.6 KiB
Diff
From 7f42013d33 Mon Sep 17 00:00:00 2001
|
|
From: Nathan Scott <nathans@redhat.com>
|
|
Subject: [PATCH] libpcp_web: add numinst overflow check in pmDiscoverDecodeMetaInDom (CWE-125/190)
|
|
|
|
Defense-in-depth for the __pmLogLoadInDom streaming path fix (commit 1).
|
|
When __pmLogLoadInDom is called with acp=NULL from the pmproxy discover
|
|
code, a garbage numinst value read from a too-small buffer could be
|
|
passed to calloc(numinst, sizeof(char *)), causing an integer overflow
|
|
in the allocation size.
|
|
|
|
Add explicit validation that numinst > 0 and does not overflow SIZE_MAX
|
|
before the calloc in pmDiscoverDecodeMetaInDom(). The primary fix
|
|
(rlen and numinst validation in __pmLogLoadInDom itself) prevents this
|
|
value from being garbage in the first place.
|
|
|
|
Reported-by: Francisco Alisson Bezerra, TIM Security Red Team
|
|
Reported-by: Lucas Gabriel Alves, TIM Security Red Team
|
|
Reported-by: Massimiliano Brolli, TIM Security Red Team
|
|
|
|
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
|
|
|
---
|
|
diff --git a/src/libpcp_web/src/discover.c b/src/libpcp_web/src/discover.c
|
|
index 0c7565340d..7363755746 100644
|
|
--- a/src/libpcp_web/src/discover.c
|
|
+++ b/src/libpcp_web/src/discover.c
|
|
@@ -1954,6 +1954,11 @@ pmDiscoverDecodeMetaInDom(__int32_t *buf, int len, int type, __pmTimestamp *tsp,
|
|
*/
|
|
char **namelist;
|
|
int i;
|
|
+ if (lid.numinst <= 0 ||
|
|
+ (size_t)lid.numinst > SIZE_MAX / sizeof(char *)) {
|
|
+ __pmFreeLogInDom(&lid);
|
|
+ return -EINVAL;
|
|
+ }
|
|
namelist = (char **)malloc(lid.numinst * sizeof(char *));
|
|
if (namelist == NULL) {
|
|
pmNoMem("pmDiscoverDecodeMetaInDom", lid.numinst * sizeof(char *), PM_FATAL_ERR);
|