diff options
Diffstat (limited to 'meta/recipes-connectivity/openssh/openssh/CVE-2019-6109.patch')
-rw-r--r-- | meta/recipes-connectivity/openssh/openssh/CVE-2019-6109.patch | 275 |
1 files changed, 275 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2019-6109.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2019-6109.patch new file mode 100644 index 0000000000..dabe4a6c97 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2019-6109.patch | |||
@@ -0,0 +1,275 @@ | |||
1 | From 15d47c3bd8551521240bc459fc004c280daef817 Mon Sep 17 00:00:00 2001 | ||
2 | From: "dtucker@openbsd.org" <dtucker@openbsd.org> | ||
3 | Date: Wed, 23 Jan 2019 08:01:46 +0000 | ||
4 | Subject: [PATCH] upstream: Sanitize scp filenames via snmprintf. To do this we | ||
5 | move | ||
6 | |||
7 | the progressmeter formatting outside of signal handler context and have the | ||
8 | atomicio callback called for EINTR too. bz#2434 with contributions from djm | ||
9 | and jjelen at redhat.com, ok djm@ | ||
10 | |||
11 | OpenBSD-Commit-ID: 1af61c1f70e4f3bd8ab140b9f1fa699481db57d8 | ||
12 | CVE: CVE-2019-6109 | ||
13 | Upstream-Status: Backport | ||
14 | Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> | ||
15 | --- | ||
16 | atomicio.c | 20 +++++++++++++++----- | ||
17 | progressmeter.c | 53 ++++++++++++++++++++++++----------------------------- | ||
18 | progressmeter.h | 3 ++- | ||
19 | scp.c | 1 + | ||
20 | sftp-client.c | 16 +++++++++------- | ||
21 | 5 files changed, 51 insertions(+), 42 deletions(-) | ||
22 | |||
23 | diff --git a/atomicio.c b/atomicio.c | ||
24 | index f854a06..d91bd76 100644 | ||
25 | --- a/atomicio.c | ||
26 | +++ b/atomicio.c | ||
27 | @@ -1,4 +1,4 @@ | ||
28 | -/* $OpenBSD: atomicio.c,v 1.28 2016/07/27 23:18:12 djm Exp $ */ | ||
29 | +/* $OpenBSD: atomicio.c,v 1.29 2019/01/23 08:01:46 dtucker Exp $ */ | ||
30 | /* | ||
31 | * Copyright (c) 2006 Damien Miller. All rights reserved. | ||
32 | * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved. | ||
33 | @@ -65,9 +65,14 @@ atomicio6(ssize_t (*f) (int, void *, size_t), int fd, void *_s, size_t n, | ||
34 | res = (f) (fd, s + pos, n - pos); | ||
35 | switch (res) { | ||
36 | case -1: | ||
37 | - if (errno == EINTR) | ||
38 | + if (errno == EINTR) { | ||
39 | + /* possible SIGALARM, update callback */ | ||
40 | + if (cb != NULL && cb(cb_arg, 0) == -1) { | ||
41 | + errno = EINTR; | ||
42 | + return pos; | ||
43 | + } | ||
44 | continue; | ||
45 | - if (errno == EAGAIN || errno == EWOULDBLOCK) { | ||
46 | + } else if (errno == EAGAIN || errno == EWOULDBLOCK) { | ||
47 | #ifndef BROKEN_READ_COMPARISON | ||
48 | (void)poll(&pfd, 1, -1); | ||
49 | #endif | ||
50 | @@ -122,9 +127,14 @@ atomiciov6(ssize_t (*f) (int, const struct iovec *, int), int fd, | ||
51 | res = (f) (fd, iov, iovcnt); | ||
52 | switch (res) { | ||
53 | case -1: | ||
54 | - if (errno == EINTR) | ||
55 | + if (errno == EINTR) { | ||
56 | + /* possible SIGALARM, update callback */ | ||
57 | + if (cb != NULL && cb(cb_arg, 0) == -1) { | ||
58 | + errno = EINTR; | ||
59 | + return pos; | ||
60 | + } | ||
61 | continue; | ||
62 | - if (errno == EAGAIN || errno == EWOULDBLOCK) { | ||
63 | + } else if (errno == EAGAIN || errno == EWOULDBLOCK) { | ||
64 | #ifndef BROKEN_READV_COMPARISON | ||
65 | (void)poll(&pfd, 1, -1); | ||
66 | #endif | ||
67 | diff --git a/progressmeter.c b/progressmeter.c | ||
68 | index fe9bf52..add462d 100644 | ||
69 | --- a/progressmeter.c | ||
70 | +++ b/progressmeter.c | ||
71 | @@ -1,4 +1,4 @@ | ||
72 | -/* $OpenBSD: progressmeter.c,v 1.45 2016/06/30 05:17:05 dtucker Exp $ */ | ||
73 | +/* $OpenBSD: progressmeter.c,v 1.46 2019/01/23 08:01:46 dtucker Exp $ */ | ||
74 | /* | ||
75 | * Copyright (c) 2003 Nils Nordman. All rights reserved. | ||
76 | * | ||
77 | @@ -31,6 +31,7 @@ | ||
78 | |||
79 | #include <errno.h> | ||
80 | #include <signal.h> | ||
81 | +#include <stdarg.h> | ||
82 | #include <stdio.h> | ||
83 | #include <string.h> | ||
84 | #include <time.h> | ||
85 | @@ -39,6 +40,7 @@ | ||
86 | #include "progressmeter.h" | ||
87 | #include "atomicio.h" | ||
88 | #include "misc.h" | ||
89 | +#include "utf8.h" | ||
90 | |||
91 | #define DEFAULT_WINSIZE 80 | ||
92 | #define MAX_WINSIZE 512 | ||
93 | @@ -61,7 +63,7 @@ static void setscreensize(void); | ||
94 | void refresh_progress_meter(void); | ||
95 | |||
96 | /* signal handler for updating the progress meter */ | ||
97 | -static void update_progress_meter(int); | ||
98 | +static void sig_alarm(int); | ||
99 | |||
100 | static double start; /* start progress */ | ||
101 | static double last_update; /* last progress update */ | ||
102 | @@ -74,6 +76,7 @@ static long stalled; /* how long we have been stalled */ | ||
103 | static int bytes_per_second; /* current speed in bytes per second */ | ||
104 | static int win_size; /* terminal window size */ | ||
105 | static volatile sig_atomic_t win_resized; /* for window resizing */ | ||
106 | +static volatile sig_atomic_t alarm_fired; | ||
107 | |||
108 | /* units for format_size */ | ||
109 | static const char unit[] = " KMGT"; | ||
110 | @@ -126,9 +129,17 @@ refresh_progress_meter(void) | ||
111 | off_t bytes_left; | ||
112 | int cur_speed; | ||
113 | int hours, minutes, seconds; | ||
114 | - int i, len; | ||
115 | int file_len; | ||
116 | |||
117 | + if ((!alarm_fired && !win_resized) || !can_output()) | ||
118 | + return; | ||
119 | + alarm_fired = 0; | ||
120 | + | ||
121 | + if (win_resized) { | ||
122 | + setscreensize(); | ||
123 | + win_resized = 0; | ||
124 | + } | ||
125 | + | ||
126 | transferred = *counter - (cur_pos ? cur_pos : start_pos); | ||
127 | cur_pos = *counter; | ||
128 | now = monotime_double(); | ||
129 | @@ -158,16 +169,11 @@ refresh_progress_meter(void) | ||
130 | |||
131 | /* filename */ | ||
132 | buf[0] = '\0'; | ||
133 | - file_len = win_size - 35; | ||
134 | + file_len = win_size - 36; | ||
135 | if (file_len > 0) { | ||
136 | - len = snprintf(buf, file_len + 1, "\r%s", file); | ||
137 | - if (len < 0) | ||
138 | - len = 0; | ||
139 | - if (len >= file_len + 1) | ||
140 | - len = file_len; | ||
141 | - for (i = len; i < file_len; i++) | ||
142 | - buf[i] = ' '; | ||
143 | - buf[file_len] = '\0'; | ||
144 | + buf[0] = '\r'; | ||
145 | + snmprintf(buf+1, sizeof(buf)-1 , &file_len, "%*s", | ||
146 | + file_len * -1, file); | ||
147 | } | ||
148 | |||
149 | /* percent of transfer done */ | ||
150 | @@ -228,22 +234,11 @@ refresh_progress_meter(void) | ||
151 | |||
152 | /*ARGSUSED*/ | ||
153 | static void | ||
154 | -update_progress_meter(int ignore) | ||
155 | +sig_alarm(int ignore) | ||
156 | { | ||
157 | - int save_errno; | ||
158 | - | ||
159 | - save_errno = errno; | ||
160 | - | ||
161 | - if (win_resized) { | ||
162 | - setscreensize(); | ||
163 | - win_resized = 0; | ||
164 | - } | ||
165 | - if (can_output()) | ||
166 | - refresh_progress_meter(); | ||
167 | - | ||
168 | - signal(SIGALRM, update_progress_meter); | ||
169 | + signal(SIGALRM, sig_alarm); | ||
170 | + alarm_fired = 1; | ||
171 | alarm(UPDATE_INTERVAL); | ||
172 | - errno = save_errno; | ||
173 | } | ||
174 | |||
175 | void | ||
176 | @@ -259,10 +254,9 @@ start_progress_meter(const char *f, off_t filesize, off_t *ctr) | ||
177 | bytes_per_second = 0; | ||
178 | |||
179 | setscreensize(); | ||
180 | - if (can_output()) | ||
181 | - refresh_progress_meter(); | ||
182 | + refresh_progress_meter(); | ||
183 | |||
184 | - signal(SIGALRM, update_progress_meter); | ||
185 | + signal(SIGALRM, sig_alarm); | ||
186 | signal(SIGWINCH, sig_winch); | ||
187 | alarm(UPDATE_INTERVAL); | ||
188 | } | ||
189 | @@ -286,6 +280,7 @@ stop_progress_meter(void) | ||
190 | static void | ||
191 | sig_winch(int sig) | ||
192 | { | ||
193 | + signal(SIGWINCH, sig_winch); | ||
194 | win_resized = 1; | ||
195 | } | ||
196 | |||
197 | diff --git a/progressmeter.h b/progressmeter.h | ||
198 | index bf179dc..8f66780 100644 | ||
199 | --- a/progressmeter.h | ||
200 | +++ b/progressmeter.h | ||
201 | @@ -1,4 +1,4 @@ | ||
202 | -/* $OpenBSD: progressmeter.h,v 1.3 2015/01/14 13:54:13 djm Exp $ */ | ||
203 | +/* $OpenBSD: progressmeter.h,v 1.4 2019/01/23 08:01:46 dtucker Exp $ */ | ||
204 | /* | ||
205 | * Copyright (c) 2002 Nils Nordman. All rights reserved. | ||
206 | * | ||
207 | @@ -24,4 +24,5 @@ | ||
208 | */ | ||
209 | |||
210 | void start_progress_meter(const char *, off_t, off_t *); | ||
211 | +void refresh_progress_meter(void); | ||
212 | void stop_progress_meter(void); | ||
213 | diff --git a/scp.c b/scp.c | ||
214 | index 4f3fdcd..4a342a6 100644 | ||
215 | --- a/scp.c | ||
216 | +++ b/scp.c | ||
217 | @@ -585,6 +585,7 @@ scpio(void *_cnt, size_t s) | ||
218 | off_t *cnt = (off_t *)_cnt; | ||
219 | |||
220 | *cnt += s; | ||
221 | + refresh_progress_meter(); | ||
222 | if (limit_kbps > 0) | ||
223 | bandwidth_limit(&bwlimit, s); | ||
224 | return 0; | ||
225 | diff --git a/sftp-client.c b/sftp-client.c | ||
226 | index 4986d6d..2bc698f 100644 | ||
227 | --- a/sftp-client.c | ||
228 | +++ b/sftp-client.c | ||
229 | @@ -101,7 +101,9 @@ sftpio(void *_bwlimit, size_t amount) | ||
230 | { | ||
231 | struct bwlimit *bwlimit = (struct bwlimit *)_bwlimit; | ||
232 | |||
233 | - bandwidth_limit(bwlimit, amount); | ||
234 | + refresh_progress_meter(); | ||
235 | + if (bwlimit != NULL) | ||
236 | + bandwidth_limit(bwlimit, amount); | ||
237 | return 0; | ||
238 | } | ||
239 | |||
240 | @@ -121,8 +123,8 @@ send_msg(struct sftp_conn *conn, struct sshbuf *m) | ||
241 | iov[1].iov_base = (u_char *)sshbuf_ptr(m); | ||
242 | iov[1].iov_len = sshbuf_len(m); | ||
243 | |||
244 | - if (atomiciov6(writev, conn->fd_out, iov, 2, | ||
245 | - conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_out) != | ||
246 | + if (atomiciov6(writev, conn->fd_out, iov, 2, sftpio, | ||
247 | + conn->limit_kbps > 0 ? &conn->bwlimit_out : NULL) != | ||
248 | sshbuf_len(m) + sizeof(mlen)) | ||
249 | fatal("Couldn't send packet: %s", strerror(errno)); | ||
250 | |||
251 | @@ -138,8 +140,8 @@ get_msg_extended(struct sftp_conn *conn, struct sshbuf *m, int initial) | ||
252 | |||
253 | if ((r = sshbuf_reserve(m, 4, &p)) != 0) | ||
254 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
255 | - if (atomicio6(read, conn->fd_in, p, 4, | ||
256 | - conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in) != 4) { | ||
257 | + if (atomicio6(read, conn->fd_in, p, 4, sftpio, | ||
258 | + conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL) != 4) { | ||
259 | if (errno == EPIPE || errno == ECONNRESET) | ||
260 | fatal("Connection closed"); | ||
261 | else | ||
262 | @@ -157,8 +159,8 @@ get_msg_extended(struct sftp_conn *conn, struct sshbuf *m, int initial) | ||
263 | |||
264 | if ((r = sshbuf_reserve(m, msg_len, &p)) != 0) | ||
265 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); | ||
266 | - if (atomicio6(read, conn->fd_in, p, msg_len, | ||
267 | - conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in) | ||
268 | + if (atomicio6(read, conn->fd_in, p, msg_len, sftpio, | ||
269 | + conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL) | ||
270 | != msg_len) { | ||
271 | if (errno == EPIPE) | ||
272 | fatal("Connection closed"); | ||
273 | -- | ||
274 | 2.7.4 | ||
275 | |||