From 715a280ffcb18268f404414539b2d60be98182e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zaoral?= Date: Mon, 23 Oct 2023 14:28:27 +0200 Subject: [PATCH] fix buffer overflow with high port numbers Resolves: RHEL-14440 --- sgpio-1.2-buffer-overflow.patch | 11 +++++++++++ sgpio.spec | 7 ++++++- 2 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 sgpio-1.2-buffer-overflow.patch diff --git a/sgpio-1.2-buffer-overflow.patch b/sgpio-1.2-buffer-overflow.patch new file mode 100644 index 0000000..9a277d8 --- /dev/null +++ b/sgpio-1.2-buffer-overflow.patch @@ -0,0 +1,11 @@ +--- sgpio/sgpio.c ++++ sgpio/sgpio.c +@@ -126,7 +126,7 @@ + int id; + int host_port; + int init; +- char name[7]; ++ char name[5 /* prefix */ + 10 /* port number */ + 1 /* terminator */]; + }; + + /* structure for the disks associated with the led structure */ diff --git a/sgpio.spec b/sgpio.spec index 0b1eaf0..1166a4f 100644 --- a/sgpio.spec +++ b/sgpio.spec @@ -1,7 +1,7 @@ Summary: SGPIO captive backplane tool Name: sgpio Version: 1.2.0.10 -Release: 30%{?dist} +Release: 31%{?dist} License: GPLv2+ URL: http://sources.redhat.com/lvm2/wiki/DMRAID_Eventing Source: sgpio-1.2-0.10-src.tar.gz @@ -9,6 +9,7 @@ Source: sgpio-1.2-0.10-src.tar.gz #Source: http://sources.redhat.com/lvm2/wiki/DMRAID_Eventing?action=AttachFile&do=get&target=sgpio-1.2.tgz Patch0: sgpio-1.2-makefile.patch Patch1: sgpio-1.2-coverity.patch +Patch2: sgpio-1.2-buffer-overflow.patch BuildRequires: make BuildRequires: gcc BuildRequires: dos2unix @@ -21,6 +22,7 @@ Intel SGPIO enclosure management utility dos2unix --keepdate Makefile README %patch0 -p1 -b .makefile %patch1 -p1 -b .coverity +%patch2 -p1 -b .buffer-overflow chmod a-x * %build @@ -37,6 +39,9 @@ make clean %{_mandir}/man1/sgpio.* %changelog +* Mon Oct 23 2023 Lukáš Zaoral - 1.2.0.10-31 +- fix buffer overflow with high port numbers (RHEL-14440) + * Tue Aug 10 2021 Mohan Boddu - 1.2.0.10-30 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688