diff options
Diffstat (limited to 'meta/recipes-core/systemd/systemd/0027-journal-fix-syslog_parse_identifier.patch')
-rw-r--r-- | meta/recipes-core/systemd/systemd/0027-journal-fix-syslog_parse_identifier.patch | 77 |
1 files changed, 0 insertions, 77 deletions
diff --git a/meta/recipes-core/systemd/systemd/0027-journal-fix-syslog_parse_identifier.patch b/meta/recipes-core/systemd/systemd/0027-journal-fix-syslog_parse_identifier.patch deleted file mode 100644 index d4df0e12fd..0000000000 --- a/meta/recipes-core/systemd/systemd/0027-journal-fix-syslog_parse_identifier.patch +++ /dev/null | |||
@@ -1,77 +0,0 @@ | |||
1 | From 8ccebb04e07628f7fe10131d6cd4f19d6a0d8f45 Mon Sep 17 00:00:00 2001 | ||
2 | From: Yu Watanabe <watanabe.yu+github@gmail.com> | ||
3 | Date: Wed, 8 Aug 2018 15:06:36 +0900 | ||
4 | Subject: [PATCH] journal: fix syslog_parse_identifier() | ||
5 | |||
6 | Fixes #9829. | ||
7 | |||
8 | An out of bounds read was discovered in systemd-journald in the way it | ||
9 | parses log messages that terminate with a colon ':'. A local attacker | ||
10 | can use this flaw to disclose process memory data. | ||
11 | |||
12 | Patch backported from systemd master at | ||
13 | a6aadf4ae0bae185dc4c414d492a4a781c80ffe5. | ||
14 | |||
15 | This matches the change done for systemd-journald, hence forming the first | ||
16 | part of the fix for CVE-2018-16866. | ||
17 | --- | ||
18 | src/journal/journald-syslog.c | 6 +++--- | ||
19 | src/journal/test-journal-syslog.c | 10 ++++++++-- | ||
20 | 2 files changed, 11 insertions(+), 5 deletions(-) | ||
21 | |||
22 | diff --git a/src/journal/journald-syslog.c b/src/journal/journald-syslog.c | ||
23 | index 9dea116722..97711ac7a3 100644 | ||
24 | --- a/src/journal/journald-syslog.c | ||
25 | +++ b/src/journal/journald-syslog.c | ||
26 | @@ -194,7 +194,7 @@ size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid) | ||
27 | e = l; | ||
28 | l--; | ||
29 | |||
30 | - if (p[l-1] == ']') { | ||
31 | + if (l > 0 && p[l-1] == ']') { | ||
32 | size_t k = l-1; | ||
33 | |||
34 | for (;;) { | ||
35 | @@ -219,8 +219,8 @@ size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid) | ||
36 | if (t) | ||
37 | *identifier = t; | ||
38 | |||
39 | - if (strchr(WHITESPACE, p[e])) | ||
40 | - e++; | ||
41 | + e += strspn(p + e, WHITESPACE); | ||
42 | + | ||
43 | *buf = p + e; | ||
44 | return e; | ||
45 | } | ||
46 | diff --git a/src/journal/test-journal-syslog.c b/src/journal/test-journal-syslog.c | ||
47 | index 9ba86f6c8a..05f759817e 100644 | ||
48 | --- a/src/journal/test-journal-syslog.c | ||
49 | +++ b/src/journal/test-journal-syslog.c | ||
50 | @@ -5,8 +5,8 @@ | ||
51 | #include "macro.h" | ||
52 | #include "string-util.h" | ||
53 | |||
54 | -static void test_syslog_parse_identifier(const char* str, | ||
55 | - const char *ident, const char*pid, int ret) { | ||
56 | +static void test_syslog_parse_identifier(const char *str, | ||
57 | + const char *ident, const char *pid, int ret) { | ||
58 | const char *buf = str; | ||
59 | _cleanup_free_ char *ident2 = NULL, *pid2 = NULL; | ||
60 | int ret2; | ||
61 | @@ -21,7 +21,13 @@ static void test_syslog_parse_identifier(const char* str, | ||
62 | int main(void) { | ||
63 | test_syslog_parse_identifier("pidu[111]: xxx", "pidu", "111", 11); | ||
64 | test_syslog_parse_identifier("pidu: xxx", "pidu", NULL, 6); | ||
65 | + test_syslog_parse_identifier("pidu: xxx", "pidu", NULL, 7); | ||
66 | test_syslog_parse_identifier("pidu xxx", NULL, NULL, 0); | ||
67 | + test_syslog_parse_identifier(":", "", NULL, 1); | ||
68 | + test_syslog_parse_identifier(": ", "", NULL, 3); | ||
69 | + test_syslog_parse_identifier("pidu:", "pidu", NULL, 5); | ||
70 | + test_syslog_parse_identifier("pidu: ", "pidu", NULL, 6); | ||
71 | + test_syslog_parse_identifier("pidu : ", NULL, NULL, 0); | ||
72 | |||
73 | return 0; | ||
74 | } | ||
75 | -- | ||
76 | 2.11.0 | ||
77 | |||