From 670326cb0bb9aa62b9a01d166c1e1fe009b632f1 Mon Sep 17 00:00:00 2001
From: Jan Rybar <jrybar@redhat.com>
Date: Wed, 18 Jan 2023 15:49:14 +0000
Subject: [PATCH] ps: out-of-bonds read in quick mode

---
 procps-ng.spec             |  7 ++++++-
 ps-out-of-bonds-read.patch | 23 +++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 ps-out-of-bonds-read.patch

diff --git a/procps-ng.spec b/procps-ng.spec
index 9fce8ac..57fe343 100644
--- a/procps-ng.spec
+++ b/procps-ng.spec
@@ -4,7 +4,7 @@
 Summary: System and process monitoring utilities
 Name: procps-ng
 Version: 3.3.17
-Release: 9%{?dist}
+Release: 10%{?dist}
 License: GPL+ and GPLv2 and GPLv2+ and GPLv3+ and LGPLv2+
 URL: https://sourceforge.net/projects/procps-ng/
 
@@ -23,6 +23,7 @@ Patch5: sysctl-support-systemd-globs.patch
 Patch6: sysctl-print-dotted-keys-again.patch
 Patch7: pgrep-uid-gid-overflow-backport.patch
 Patch8: display-sig-unsafe.patch
+Patch9: ps-out-of-bonds-read.patch
 
 
 BuildRequires: make
@@ -166,6 +167,10 @@ ln -s %{_bindir}/pidof %{buildroot}%{_sbindir}/pidof
 %files i18n -f %{name}.lang
 
 %changelog
+* Wed Jan 18 2023 Jan Rybar <jrybar@redhat.com> - 3.3.17-10
+- ps: out-of-bonds read in quick mode
+- Resolves: rhbz#2161648
+
 * Tue Nov 29 2022 Jan Rybar <jrybar@redhat.com> - 3.3.17-9
 - display.c: backport: async-signal-unsafe handler deadlocks on SIGHUP
 - Resolves: rhbz#2141697
diff --git a/ps-out-of-bonds-read.patch b/ps-out-of-bonds-read.patch
new file mode 100644
index 0000000..a0030cb
--- /dev/null
+++ b/ps-out-of-bonds-read.patch
@@ -0,0 +1,23 @@
+diff --git a/ps/display.c b/ps/display.c
+index 1927fd6..e7ab351 100644
+--- a/ps/display.c
++++ b/ps/display.c
+@@ -357,7 +357,7 @@ static void simple_spew(void){
+   if (selection_list && selection_list->typecode == SEL_PID_QUICK) {
+     flags |= PROC_PID;
+ 
+-    pidlist = (pid_t*) malloc(selection_list->n * sizeof(pid_t));
++    pidlist = (pid_t*) malloc((selection_list->n + 1) * sizeof(pid_t));
+     if (!pidlist) {
+       fprintf(stderr, _("error: not enough memory\n"));
+       exit(1);
+@@ -366,6 +366,9 @@ static void simple_spew(void){
+     for (i = 0; i < selection_list->n; i++) {
+       pidlist[i] = selection_list->u[selection_list->n-i-1].pid;
+     }
++
++    // delimit the array with nul object (0); RHBZ#2153813
++    pidlist[selection_list->n] = (pid_t)0;
+   }
+ 
+   ptp = openproc(flags, pidlist);