summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core/glibc/glibc/CVE-2012-3406-Stack-overflow-in-vfprintf-BZ-16617.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-core/glibc/glibc/CVE-2012-3406-Stack-overflow-in-vfprintf-BZ-16617.patch')
-rw-r--r--meta/recipes-core/glibc/glibc/CVE-2012-3406-Stack-overflow-in-vfprintf-BZ-16617.patch339
1 files changed, 339 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/CVE-2012-3406-Stack-overflow-in-vfprintf-BZ-16617.patch b/meta/recipes-core/glibc/glibc/CVE-2012-3406-Stack-overflow-in-vfprintf-BZ-16617.patch
new file mode 100644
index 0000000000..92b85014b3
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/CVE-2012-3406-Stack-overflow-in-vfprintf-BZ-16617.patch
@@ -0,0 +1,339 @@
1From a5357b7ce2a2982c5778435704bcdb55ce3667a0 Mon Sep 17 00:00:00 2001
2From: Jeff Law <law@redhat.com>
3Date: Mon, 15 Dec 2014 10:09:32 +0100
4Subject: [PATCH] CVE-2012-3406: Stack overflow in vfprintf [BZ #16617]
5
6A larger number of format specifiers coudld cause a stack overflow,
7potentially allowing to bypass _FORTIFY_SOURCE format string
8protection.
9---
10 ChangeLog | 9 +++++++
11 NEWS | 13 +++++----
12 stdio-common/Makefile | 2 +-
13 stdio-common/bug23-2.c | 70 +++++++++++++++++++++++++++++++++++++++++++++++++
14 stdio-common/bug23-3.c | 50 +++++++++++++++++++++++++++++++++++
15 stdio-common/bug23-4.c | 31 ++++++++++++++++++++++
16 stdio-common/vfprintf.c | 40 ++++++++++++++++++++++++++--
17 7 files changed, 207 insertions(+), 8 deletions(-)
18 create mode 100644 stdio-common/bug23-2.c
19 create mode 100644 stdio-common/bug23-3.c
20 create mode 100644 stdio-common/bug23-4.c
21
22Index: git/ChangeLog
23===================================================================
24--- git.orig/ChangeLog
25+++ git/ChangeLog
26@@ -1,3 +1,12 @@
27+2014-12-15 Jeff Law <law@redhat.com>
28+
29+ [BZ #16617]
30+ * stdio-common/vfprintf.c (vfprintf): Allocate large specs array
31+ on the heap. (CVE-2012-3406)
32+ * stdio-common/bug23-2.c, stdio-common/bug23-3.c: New file.
33+ * stdio-common/bug23-4.c: New file. Test case by Joseph Myers.
34+ * stdio-common/Makefile (tests): Add bug23-2, bug23-3, bug23-4.
35+
36 2014-11-19 Carlos O'Donell <carlos@redhat.com>
37 Florian Weimer <fweimer@redhat.com>
38 Joseph Myers <joseph@codesourcery.com>
39Index: git/NEWS
40===================================================================
41--- git.orig/NEWS
42+++ git/NEWS
43@@ -13,24 +13,28 @@ Version 2.20
44 15698, 15804, 15894, 15946, 16002, 16064, 16095, 16194, 16198, 16275,
45 16284, 16287, 16315, 16348, 16349, 16354, 16357, 16362, 16447, 16516,
46 16532, 16539, 16545, 16561, 16562, 16564, 16574, 16599, 16600, 16609,
47- 16610, 16611, 16613, 16619, 16623, 16629, 16632, 16634, 16639, 16642,
48- 16648, 16649, 16670, 16674, 16677, 16680, 16681, 16683, 16689, 16695,
49- 16701, 16706, 16707, 16712, 16713, 16714, 16724, 16731, 16739, 16740,
50- 16743, 16754, 16758, 16759, 16760, 16770, 16786, 16789, 16791, 16796,
51- 16799, 16800, 16815, 16823, 16824, 16831, 16838, 16839, 16849, 16854,
52- 16876, 16877, 16878, 16882, 16885, 16888, 16890, 16892, 16912, 16915,
53- 16916, 16917, 16918, 16922, 16927, 16928, 16932, 16943, 16958, 16965,
54- 16966, 16967, 16977, 16978, 16984, 16990, 16996, 17009, 17022, 17031,
55- 17042, 17048, 17050, 17058, 17061, 17062, 17069, 17075, 17078, 17079,
56- 17084, 17086, 17088, 17092, 17097, 17125, 17135, 17137, 17150, 17153,
57- 17187, 17213, 17259, 17261, 17262, 17263, 17319, 17325, 17354, 17625.
58-
59+ 16610, 16611, 16613, 16617, 16619, 16623, 16629, 16632, 16634, 16639,
60+ 16642, 16648, 16649, 16670, 16674, 16677, 16680, 16681, 16683, 16689,
61+ 16695, 16701, 16706, 16707, 16712, 16713, 16714, 16724, 16731, 16739,
62+ 16740, 16743, 16754, 16758, 16759, 16760, 16770, 16786, 16789, 16791,
63+ 16796, 16799, 16800, 16815, 16823, 16824, 16831, 16838, 16839, 16849,
64+ 16854, 16876, 16877, 16878, 16882, 16885, 16888, 16890, 16892, 16912,
65+ 16915, 16916, 16917, 16918, 16922, 16927, 16928, 16932, 16943, 16958,
66+ 16965, 16966, 16967, 16977, 16978, 16984, 16990, 16996, 17009, 17022,
67+ 17031, 17042, 17048, 17050, 17058, 17061, 17062, 17069, 17075, 17078,
68+ 17079, 17084, 17086, 17088, 17092, 17097, 17125, 17135, 17137, 17150,
69+ 17153, 17187, 17213, 17259, 17261, 17262, 17263, 17319, 17325, 17354,
70+ 17625.
71+
72 * CVE-2104-7817 The wordexp function could ignore the WRDE_NOCMD flag
73 under certain input conditions resulting in the execution of a shell for
74 command substitution when the applicaiton did not request it. The
75 implementation now checks WRDE_NOCMD immediately before executing the
76 shell and returns the error WRDE_CMDSUB as expected.
77
78+* CVE-2012-3406 printf-style functions could run into a stack overflow when
79+ processing format strings with a large number of format specifiers.
80+
81 * Reverted change of ABI data structures for s390 and s390x:
82 On s390 and s390x the size of struct ucontext and jmp_buf was increased in
83 2.19. This change is reverted in 2.20. The introduced 2.19 symbol versions
84Index: git/stdio-common/bug23-2.c
85===================================================================
86--- /dev/null
87+++ git/stdio-common/bug23-2.c
88@@ -0,0 +1,70 @@
89+#include <stdio.h>
90+#include <string.h>
91+#include <stdlib.h>
92+
93+static const char expected[] = "\
94+\n\
95+a\n\
96+abbcd55\
97+\n\
98+a\n\
99+abbcd55\
100+\n\
101+a\n\
102+abbcd55\
103+\n\
104+a\n\
105+abbcd55\
106+\n\
107+a\n\
108+abbcd55\
109+\n\
110+a\n\
111+abbcd55\
112+\n\
113+a\n\
114+abbcd55\
115+\n\
116+a\n\
117+abbcd55\
118+\n\
119+a\n\
120+abbcd55\
121+\n\
122+a\n\
123+abbcd55\
124+\n\
125+a\n\
126+abbcd55\
127+\n\
128+a\n\
129+abbcd55\
130+\n\
131+a\n\
132+abbcd55%%%%%%%%%%%%%%%%%%%%%%%%%%\n";
133+
134+static int
135+do_test (void)
136+{
137+ char *buf = malloc (strlen (expected) + 1);
138+ snprintf (buf, strlen (expected) + 1,
139+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
140+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
141+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
142+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
143+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
144+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
145+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
146+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
147+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
148+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
149+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
150+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
151+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
152+ "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%\n",
153+ "a", "b", "c", "d", 5);
154+ return strcmp (buf, expected) != 0;
155+}
156+
157+#define TEST_FUNCTION do_test ()
158+#include "../test-skeleton.c"
159Index: git/stdio-common/bug23-3.c
160===================================================================
161--- /dev/null
162+++ git/stdio-common/bug23-3.c
163@@ -0,0 +1,50 @@
164+#include <stdio.h>
165+#include <string.h>
166+#include <stdlib.h>
167+
168+int
169+do_test (void)
170+{
171+ size_t instances = 16384;
172+#define X0 "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
173+ const char *item = "\na\nabbcd55";
174+#define X3 X0 X0 X0 X0 X0 X0 X0 X0
175+#define X6 X3 X3 X3 X3 X3 X3 X3 X3
176+#define X9 X6 X6 X6 X6 X6 X6 X6 X6
177+#define X12 X9 X9 X9 X9 X9 X9 X9 X9
178+#define X14 X12 X12 X12 X12
179+#define TRAILER "%%%%%%%%%%%%%%%%%%%%%%%%%%"
180+#define TRAILER2 TRAILER TRAILER
181+ size_t length = instances * strlen (item) + strlen (TRAILER) + 1;
182+
183+ char *buf = malloc (length + 1);
184+ snprintf (buf, length + 1,
185+ X14 TRAILER2 "\n",
186+ "a", "b", "c", "d", 5);
187+
188+ const char *p = buf;
189+ size_t i;
190+ for (i = 0; i < instances; ++i)
191+ {
192+ const char *expected;
193+ for (expected = item; *expected; ++expected)
194+ {
195+ if (*p != *expected)
196+ {
197+ printf ("mismatch at offset %zu (%zu): expected %d, got %d\n",
198+ (size_t) (p - buf), i, *expected & 0xFF, *p & 0xFF);
199+ return 1;
200+ }
201+ ++p;
202+ }
203+ }
204+ if (strcmp (p, TRAILER "\n") != 0)
205+ {
206+ printf ("mismatch at trailer: [%s]\n", p);
207+ return 1;
208+ }
209+ free (buf);
210+ return 0;
211+}
212+#define TEST_FUNCTION do_test ()
213+#include "../test-skeleton.c"
214Index: git/stdio-common/bug23-4.c
215===================================================================
216--- /dev/null
217+++ git/stdio-common/bug23-4.c
218@@ -0,0 +1,31 @@
219+#include <stdio.h>
220+#include <stdlib.h>
221+#include <string.h>
222+#include <sys/resource.h>
223+
224+#define LIMIT 1000000
225+
226+int
227+main (void)
228+{
229+ struct rlimit lim;
230+ getrlimit (RLIMIT_STACK, &lim);
231+ lim.rlim_cur = 1048576;
232+ setrlimit (RLIMIT_STACK, &lim);
233+ char *fmtstr = malloc (4 * LIMIT + 1);
234+ if (fmtstr == NULL)
235+ abort ();
236+ char *output = malloc (LIMIT + 1);
237+ if (output == NULL)
238+ abort ();
239+ for (size_t i = 0; i < LIMIT; i++)
240+ memcpy (fmtstr + 4 * i, "%1$d", 4);
241+ fmtstr[4 * LIMIT] = '\0';
242+ int ret = snprintf (output, LIMIT + 1, fmtstr, 0);
243+ if (ret != LIMIT)
244+ abort ();
245+ for (size_t i = 0; i < LIMIT; i++)
246+ if (output[i] != '0')
247+ abort ();
248+ return 0;
249+}
250Index: git/stdio-common/vfprintf.c
251===================================================================
252--- git.orig/stdio-common/vfprintf.c
253+++ git/stdio-common/vfprintf.c
254@@ -276,6 +276,12 @@ vfprintf (FILE *s, const CHAR_T *format,
255 /* For the argument descriptions, which may be allocated on the heap. */
256 void *args_malloced = NULL;
257
258+ /* For positional argument handling. */
259+ struct printf_spec *specs;
260+
261+ /* Track if we malloced the SPECS array and thus must free it. */
262+ bool specs_malloced = false;
263+
264 /* This table maps a character into a number representing a
265 class. In each step there is a destination label for each
266 class. */
267@@ -1699,8 +1705,8 @@ do_positional:
268 size_t nspecs = 0;
269 /* A more or less arbitrary start value. */
270 size_t nspecs_size = 32 * sizeof (struct printf_spec);
271- struct printf_spec *specs = alloca (nspecs_size);
272
273+ specs = alloca (nspecs_size);
274 /* The number of arguments the format string requests. This will
275 determine the size of the array needed to store the argument
276 attributes. */
277@@ -1743,11 +1749,39 @@ do_positional:
278 if (nspecs * sizeof (*specs) >= nspecs_size)
279 {
280 /* Extend the array of format specifiers. */
281+ if (nspecs_size * 2 < nspecs_size)
282+ {
283+ __set_errno (ENOMEM);
284+ done = -1;
285+ goto all_done;
286+ }
287 struct printf_spec *old = specs;
288- specs = extend_alloca (specs, nspecs_size, 2 * nspecs_size);
289+ if (__libc_use_alloca (2 * nspecs_size))
290+ specs = extend_alloca (specs, nspecs_size, 2 * nspecs_size);
291+ else
292+ {
293+ nspecs_size *= 2;
294+ specs = malloc (nspecs_size);
295+ if (specs == NULL)
296+ {
297+ __set_errno (ENOMEM);
298+ specs = old;
299+ done = -1;
300+ goto all_done;
301+ }
302+ }
303
304 /* Copy the old array's elements to the new space. */
305 memmove (specs, old, nspecs * sizeof (*specs));
306+
307+ /* If we had previously malloc'd space for SPECS, then
308+ release it after the copy is complete. */
309+ if (specs_malloced)
310+ free (old);
311+
312+ /* Now set SPECS_MALLOCED if needed. */
313+ if (!__libc_use_alloca (nspecs_size))
314+ specs_malloced = true;
315 }
316
317 /* Parse the format specifier. */
318@@ -2068,6 +2102,8 @@ do_positional:
319 }
320
321 all_done:
322+ if (specs_malloced)
323+ free (specs);
324 if (__glibc_unlikely (args_malloced != NULL))
325 free (args_malloced);
326 if (__glibc_unlikely (workstart != NULL))
327Index: git/stdio-common/Makefile
328===================================================================
329--- git.orig/stdio-common/Makefile
330+++ git/stdio-common/Makefile
331@@ -66,7 +66,7 @@ tests := tstscanf test_rdwr test-popen t
332 tst-fwrite bug16 bug17 tst-sprintf2 bug18 \
333 bug19 tst-popen2 scanf14 scanf15 bug21 bug22 scanf16 scanf17 \
334 tst-setvbuf1 bug23 bug24 bug-vfprintf-nargs tst-sprintf3 bug25 \
335- tst-printf-round bug26
336+ tst-printf-round bug23-2 bug23-3 bug23-4
337
338 tests-$(OPTION_EGLIBC_LOCALE_CODE) \
339 += tst-sscanf tst-swprintf test-vfprintf bug14 scanf13 tst-grouping
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-04-26 23:48:03 +0000