rpms/perl-FCGI
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Resolves: RHEL-92161

Browse Source 
Fix CVE-2025-40907 (integer overflow when parsing FastCGI parameters)
This commit is contained in:
Jitka Plesnikova 2025-06-03 09:02:23 +02:00
parent cb0a3892a2
commit 9a09db49e6
3 changed files with 141 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

83
FCGI-0.82-Fix-size_t-overflow-in-Malloc-argument-in-ReadParams.patch Normal file
View File

@ -0,0 +1,83 @@
From 7c476394e799f39f749d7a7a50f62e5d3ec8db61 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Mon, 19 May 2025 13:49:32 +0200
Subject: [PATCH] Fix size_t overflow in Malloc() argument in ReadParams()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
There were still two issues after commit
b0eabcaf4d4f371514891a52115c746815c2ff15 (Update fcgiapp.c, Fixing an
integer overflow (CVE-2025-23016)):
* Signed int overflow in "nameLen + valueLen + 2" expression.
* Sizes of size_t and int types are in general unrelated.
This fix resolves both of the issues.
Related to CVE-2025-23016.
Resolve #67.
<https://github.com/FastCGI-Archives/fcgi2/pull/77>
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
libfcgi/fcgiapp.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/fcgiapp.c b/fcgiapp.c
index 99c3630..0cd3dd1 100644
--- a/fcgiapp.c
+++ b/fcgiapp.c
@@ -18,6 +18,7 @@
#include <memory.h> /* for memchr() */
#include <stdarg.h>
#include <stdio.h>
+#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
@@ -1160,6 +1161,7 @@ char *FCGX_GetParam(const char *name, FCGX_ParamArray envp)
static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
{
int nameLen, valueLen;
+ size_t totalLen;
unsigned char lenBuff[3];
char *nameValue;
@@ -1175,7 +1177,7 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
}
nameLen = ((nameLen & 0x7f) << 24) + (lenBuff[0] << 16)
+ (lenBuff[1] << 8) + lenBuff[2];
- if (nameLen >= INT_MAX) {
+ if (nameLen >= INT_MAX || nameLen >= SIZE_MAX) {
SetError(stream, FCGX_PARAMS_ERROR);
return -1;
}
@@ -1191,16 +1193,21 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
}
valueLen = ((valueLen & 0x7f) << 24) + (lenBuff[0] << 16)
+ (lenBuff[1] << 8) + lenBuff[2];
- if (valueLen >= INT_MAX) {
+ if (valueLen >= INT_MAX || valueLen >= SIZE_MAX) {
SetError(stream, FCGX_PARAMS_ERROR);
return -1;
}
}
+ totalLen = (size_t)nameLen + (size_t)valueLen + 2u;
+ if (totalLen < (size_t)nameLen || totalLen < (size_t)valueLen) {
+ SetError(stream, FCGX_PARAMS_ERROR);
+ return -1;
+ }
/*
* nameLen and valueLen are now valid; read the name and value
* from stream and construct a standard environment entry.
*/
- nameValue = (char *)Malloc(nameLen + valueLen + 2);
+ nameValue = (char *)Malloc(totalLen);
if(FCGX_GetStr(nameValue, nameLen, stream) != nameLen) {
SetError(stream, FCGX_PARAMS_ERROR);
free(nameValue);
--
2.49.0

46
FCGI-0.82-Update-fcgiapp.c.patch Normal file
View File

@ -0,0 +1,46 @@
From b0eabcaf4d4f371514891a52115c746815c2ff15 Mon Sep 17 00:00:00 2001
From: Pycatchown <39068868+Pycatchown@users.noreply.github.com>
Date: Tue, 8 Apr 2025 17:39:30 +0200
Subject: [PATCH] Update fcgiapp.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixing an integer overflow (CVE-2025-23016)
<https://github.com/FastCGI-Archives/fcgi2/pull/74>
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
libfcgi/fcgiapp.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fcgiapp.c b/fcgiapp.c
index 4ffe318..99c3630 100644
--- a/fcgiapp.c
+++ b/fcgiapp.c
@@ -1175,6 +1175,10 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
}
nameLen = ((nameLen & 0x7f) << 24) + (lenBuff[0] << 16)
+ (lenBuff[1] << 8) + lenBuff[2];
+ if (nameLen >= INT_MAX) {
+ SetError(stream, FCGX_PARAMS_ERROR);
+ return -1;
+ }
}
if((valueLen = FCGX_GetChar(stream)) == EOF) {
SetError(stream, FCGX_PARAMS_ERROR);
@@ -1187,6 +1191,10 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
}
valueLen = ((valueLen & 0x7f) << 24) + (lenBuff[0] << 16)
+ (lenBuff[1] << 8) + lenBuff[2];
+ if (valueLen >= INT_MAX) {
+ SetError(stream, FCGX_PARAMS_ERROR);
+ return -1;
+ }
}
/*
* nameLen and valueLen are now valid; read the name and value
--
2.49.0

13
perl-FCGI.spec
View File

@ -7,7 +7,7 @@ Summary: FastCGI Perl bindings
# needed to properly replace/obsolete fcgi-perl
Epoch: 1
Version: 0.82
Release: 13%{?dist}
Release: 14%{?dist}
# eg/echo.pl: "See the LICENSE file"
# fastcgi.h: "See the LICENSE file"
# FCGI.pm: "See the LICENSE file"
@ -27,6 +27,14 @@ Source0: https://cpan.metacpan.org/authors/id/E/ET/ETHER/FCGI-%{version}.
# Fix CVE-2012-6687 in the bundled fcgi library, bug #1190294, CPAN RT#118405,
# patch copied from Debian's libfcgi-perl.
Patch0: FCGI-0.78-CVE-2012-6687.patch
# 1/2 Fix CVE-2025-40907 in the bundled fcgi library, bug #2366847,
# <https://github.com/perl-catalyst/FCGI/issues/14>, copied from fcgi2 library
# <https://github.com/FastCGI-Archives/fcgi2/issues/67>.
Patch1: FCGI-0.82-Update-fcgiapp.c.patch
# 2/2 Fix CVE-2025-40907 in the bundled fcgi library, bug #2366847,
# <https://github.com/perl-catalyst/FCGI/issues/14>, copied from fcgi2 library
# <https://github.com/FastCGI-Archives/fcgi2/issues/67>.
Patch2: FCGI-0.82-Fix-size_t-overflow-in-Malloc-argument-in-ReadParams.patch
URL: https://metacpan.org/release/FCGI
# bash for sh executed from Makefile.PL
BuildRequires: bash
@ -129,6 +137,9 @@ make test
%{_libexecdir}/%{name}
%changelog
* Tue Jun 03 2025 Jitka Plesnikova <jplesnik@redhat.com> - 1:0.82-14
- Fix CVE-2025-40907 (integer overflow when parsing FastCGI parameters)
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1:0.82-13
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018