From c15130e80eb40e80dccc140ca79cae8b01324e04 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Wed, 3 Feb 2016 11:59:17 +0100 Subject: glibc: CVE-2015-8778 Fixes integer overflow in hcreate and hcreate_r. References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8778 Upstream bug: https://sourceware.org/bugzilla/show_bug.cgi?id=18240 CVE assignment: http://seclists.org/oss-sec/2016/q1/153 Upstream fix: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=287de30e170cb765ed326d23d22791a81aab6e0f Signed-off-by: Sona Sarmadi Signed-off-by: Tudor Florea --- meta/recipes-core/glibc/glibc/CVE-2015-8778.patch | 187 ++++++++++++++++++++++ meta/recipes-core/glibc/glibc_2.20.bb | 1 + 2 files changed, 188 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/CVE-2015-8778.patch diff --git a/meta/recipes-core/glibc/glibc/CVE-2015-8778.patch b/meta/recipes-core/glibc/glibc/CVE-2015-8778.patch new file mode 100644 index 0000000000..d374b77173 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/CVE-2015-8778.patch @@ -0,0 +1,187 @@ +From 287de30e170cb765ed326d23d22791a81aab6e0f Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Thu, 28 Jan 2016 13:59:11 +0100 +Subject: [PATCH] Improve check against integer wraparound in hcreate_r [BZ +#18240] + +Upstream-Status: Backport +CVE: CVE-2015-8778 +[Yocto # 8980] + +(cherry picked from commit bae7c7c764413b23e61cb099ce33be4c4ee259bb) + +Signed-off-by: Sona Sarmadi +--- + ChangeLog | 13 ++++++++++ + misc/Makefile | 2 +- + misc/bug18240.c | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + misc/hsearch_r.c | 28 ++++++++++++--------- + 4 files changed, 106 insertions(+), 12 deletions(-) + create mode 100644 misc/bug18240.c + +diff --git a/ChangeLog b/ChangeLog +index ed4a5fa..d86dc22 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,3 +1,16 @@ ++2016-01-27 Paul Eggert ++ ++ [BZ #18240] ++ * misc/hsearch_r.c (isprime, __hcreate_r): Protect against ++ unsigned int wraparound. ++ ++2016-01-27 Florian Weimer ++ ++ [BZ #18240] ++ * misc/bug18240.c: New test. ++ * misc/Makefile (tests): Add it. ++ ++ + 2015-09-26 Paul Pluzhnikov + + [BZ #18985] +diff --git a/misc/Makefile b/misc/Makefile +index 95da2cd..db09d12 100644 +--- a/misc/Makefile ++++ b/misc/Makefile +@@ -83,7 +83,7 @@ install-lib := libg.a + gpl2lgpl := error.c error.h + + tests := tst-dirname tst-tsearch tst-fdset tst-mntent tst-hsearch \ +- tst-pselect tst-insremque tst-mntent2 bug-hsearch1 ++ tst-pselect tst-insremque tst-mntent2 bug-hsearch1 bug18240 + tests-$(OPTION_POSIX_WIDE_CHAR_DEVICE_IO) += tst-error1 + tests-$(OPTION_EGLIBC_FCVT) += tst-efgcvt + ifeq ($(run-built-tests),yes) +diff --git a/misc/bug18240.c b/misc/bug18240.c +new file mode 100644 +index 0000000..4b26865 +--- /dev/null ++++ b/misc/bug18240.c +@@ -0,0 +1,75 @@ ++/* Test integer wraparound in hcreate. ++ Copyright (C) 2016 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++static void ++test_size (size_t size) ++{ ++ int res = hcreate (size); ++ if (res == 0) ++ { ++ if (errno == ENOMEM) ++ return; ++ printf ("error: hcreate (%zu): %m\n", size); ++ exit (1); ++ } ++ char *keys[100]; ++ for (int i = 0; i < 100; ++i) ++ { ++ if (asprintf (keys + i, "%d", i) < 0) ++ { ++ printf ("error: asprintf: %m\n"); ++ exit (1); ++ } ++ ENTRY e = { keys[i], (char *) "value" }; ++ if (hsearch (e, ENTER) == NULL) ++ { ++ printf ("error: hsearch (\"%s\"): %m\n", keys[i]); ++ exit (1); ++ } ++ } ++ hdestroy (); ++ ++ for (int i = 0; i < 100; ++i) ++ free (keys[i]); ++} ++ ++static int ++do_test (void) ++{ ++ test_size (500); ++ test_size (-1); ++ test_size (-3); ++ test_size (INT_MAX - 2); ++ test_size (INT_MAX - 1); ++ test_size (INT_MAX); ++ test_size (((unsigned) INT_MAX) + 1); ++ test_size (UINT_MAX - 2); ++ test_size (UINT_MAX - 1); ++ test_size (UINT_MAX); ++ return 0; ++} ++ ++#define TEST_FUNCTION do_test () ++#include "../test-skeleton.c" +diff --git a/misc/hsearch_r.c b/misc/hsearch_r.c +index 81c27d8..746fcaa 100644 +--- a/misc/hsearch_r.c ++++ b/misc/hsearch_r.c +@@ -46,15 +46,12 @@ static int + isprime (unsigned int number) + { + /* no even number will be passed */ +- unsigned int div = 3; +- +- while (div * div < number && number % div != 0) +- div += 2; +- +- return number % div != 0; ++ for (unsigned int div = 3; div <= number / div; div += 2) ++ if (number % div == 0) ++ return 0; ++ return 1; + } + +- + /* Before using the hash table we must allocate memory for it. + Test for an existing table are done. We allocate one element + more as the found prime number says. This is done for more effective +@@ -81,10 +78,19 @@ hcreate_r (nel, htab) + use will not work. */ + if (nel < 3) + nel = 3; +- /* Change nel to the first prime number not smaller as nel. */ +- nel |= 1; /* make odd */ +- while (!isprime (nel)) +- nel += 2; ++ ++ /* Change nel to the first prime number in the range [nel, UINT_MAX - 2], ++ The '- 2' means 'nel += 2' cannot overflow. */ ++ for (nel |= 1; ; nel += 2) ++ { ++ if (UINT_MAX - 2 < nel) ++ { ++ __set_errno (ENOMEM); ++ return 0; ++ } ++ if (isprime (nel)) ++ break; ++ } + + htab->size = nel; + htab->filled = 0; +-- +1.9.1 + diff --git a/meta/recipes-core/glibc/glibc_2.20.bb b/meta/recipes-core/glibc/glibc_2.20.bb index 7bf4dbabf7..b9891d85ce 100644 --- a/meta/recipes-core/glibc/glibc_2.20.bb +++ b/meta/recipes-core/glibc/glibc_2.20.bb @@ -53,6 +53,7 @@ CVEPATCHES = "\ file://CVE-2014-9761_2.patch \ file://CVE-2015-8776.patch \ file://CVE-2015-8777.patch \ + file://CVE-2015-8778.patch \ " LIC_FILES_CHKSUM = "file://LICENSES;md5=e9a558e243b36d3209f380deb394b213 \ file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \ -- cgit v1.2.3-54-g00ecf