diff options
| -rw-r--r-- | meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch | 111 | ||||
| -rw-r--r-- | meta/recipes-connectivity/openssh/openssh_9.7p1.bb | 1 |
2 files changed, 0 insertions, 112 deletions
diff --git a/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch b/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch deleted file mode 100644 index 20036da931..0000000000 --- a/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch +++ /dev/null | |||
| @@ -1,111 +0,0 @@ | |||
| 1 | From 3328e98bcbf2930cd7eea3e6c92ad5dcbdf4794f Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Yuanjie Huang <yuanjie.huang@windriver.com> | ||
| 3 | Date: Wed, 24 Aug 2016 03:15:43 +0000 | ||
| 4 | Subject: [PATCH] Fix potential signed overflow in pointer arithmatic | ||
| 5 | |||
| 6 | Pointer arithmatic results in implementation defined signed integer | ||
| 7 | type, so that 's - src' in strlcpy and others may trigger signed overflow. | ||
| 8 | In case of compilation by gcc or clang with -ftrapv option, the overflow | ||
| 9 | would lead to program abort. | ||
| 10 | |||
| 11 | Upstream-Status: Submitted [http://bugzilla.mindrot.org/show_bug.cgi?id=2608] | ||
| 12 | |||
| 13 | Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com> | ||
| 14 | |||
| 15 | Complete the fix | ||
| 16 | Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> | ||
| 17 | --- | ||
| 18 | openbsd-compat/strlcat.c | 10 +++++++--- | ||
| 19 | openbsd-compat/strlcpy.c | 8 ++++++-- | ||
| 20 | openbsd-compat/strnlen.c | 8 ++++++-- | ||
| 21 | 3 files changed, 19 insertions(+), 7 deletions(-) | ||
| 22 | |||
| 23 | diff --git a/openbsd-compat/strlcat.c b/openbsd-compat/strlcat.c | ||
| 24 | index bcc1b61..124e1e3 100644 | ||
| 25 | --- a/openbsd-compat/strlcat.c | ||
| 26 | +++ b/openbsd-compat/strlcat.c | ||
| 27 | @@ -23,6 +23,7 @@ | ||
| 28 | |||
| 29 | #include <sys/types.h> | ||
| 30 | #include <string.h> | ||
| 31 | +#include <stdint.h> | ||
| 32 | |||
| 33 | /* | ||
| 34 | * Appends src to string dst of size siz (unlike strncat, siz is the | ||
| 35 | @@ -42,7 +43,7 @@ strlcat(char *dst, const char *src, size_t siz) | ||
| 36 | /* Find the end of dst and adjust bytes left but don't go past end */ | ||
| 37 | while (n-- != 0 && *d != '\0') | ||
| 38 | d++; | ||
| 39 | - dlen = d - dst; | ||
| 40 | + dlen = (uintptr_t)d - (uintptr_t)dst; | ||
| 41 | n = siz - dlen; | ||
| 42 | |||
| 43 | if (n == 0) | ||
| 44 | @@ -55,8 +56,11 @@ strlcat(char *dst, const char *src, size_t siz) | ||
| 45 | s++; | ||
| 46 | } | ||
| 47 | *d = '\0'; | ||
| 48 | - | ||
| 49 | - return(dlen + (s - src)); /* count does not include NUL */ | ||
| 50 | + /* | ||
| 51 | + * Cast pointers to unsigned type before calculation, to avoid signed | ||
| 52 | + * overflow when the string ends where the MSB has changed. | ||
| 53 | + */ | ||
| 54 | + return (dlen + ((uintptr_t)s - (uintptr_t)src)); /* count does not include NUL */ | ||
| 55 | } | ||
| 56 | |||
| 57 | #endif /* !HAVE_STRLCAT */ | ||
| 58 | diff --git a/openbsd-compat/strlcpy.c b/openbsd-compat/strlcpy.c | ||
| 59 | index b4b1b60..b06f374 100644 | ||
| 60 | --- a/openbsd-compat/strlcpy.c | ||
| 61 | +++ b/openbsd-compat/strlcpy.c | ||
| 62 | @@ -23,6 +23,7 @@ | ||
| 63 | |||
| 64 | #include <sys/types.h> | ||
| 65 | #include <string.h> | ||
| 66 | +#include <stdint.h> | ||
| 67 | |||
| 68 | /* | ||
| 69 | * Copy src to string dst of size siz. At most siz-1 characters | ||
| 70 | @@ -51,8 +52,11 @@ strlcpy(char *dst, const char *src, size_t siz) | ||
| 71 | while (*s++) | ||
| 72 | ; | ||
| 73 | } | ||
| 74 | - | ||
| 75 | - return(s - src - 1); /* count does not include NUL */ | ||
| 76 | + /* | ||
| 77 | + * Cast pointers to unsigned type before calculation, to avoid signed | ||
| 78 | + * overflow when the string ends where the MSB has changed. | ||
| 79 | + */ | ||
| 80 | + return ((uintptr_t)s - (uintptr_t)src - 1); /* count does not include NUL */ | ||
| 81 | } | ||
| 82 | |||
| 83 | #endif /* !HAVE_STRLCPY */ | ||
| 84 | diff --git a/openbsd-compat/strnlen.c b/openbsd-compat/strnlen.c | ||
| 85 | index 7ad3573..7040f1f 100644 | ||
| 86 | --- a/openbsd-compat/strnlen.c | ||
| 87 | +++ b/openbsd-compat/strnlen.c | ||
| 88 | @@ -23,6 +23,7 @@ | ||
| 89 | #include <sys/types.h> | ||
| 90 | |||
| 91 | #include <string.h> | ||
| 92 | +#include <stdint.h> | ||
| 93 | |||
| 94 | size_t | ||
| 95 | strnlen(const char *str, size_t maxlen) | ||
| 96 | @@ -31,7 +32,10 @@ strnlen(const char *str, size_t maxlen) | ||
| 97 | |||
| 98 | for (cp = str; maxlen != 0 && *cp != '\0'; cp++, maxlen--) | ||
| 99 | ; | ||
| 100 | - | ||
| 101 | - return (size_t)(cp - str); | ||
| 102 | + /* | ||
| 103 | + * Cast pointers to unsigned type before calculation, to avoid signed | ||
| 104 | + * overflow when the string ends where the MSB has changed. | ||
| 105 | + */ | ||
| 106 | + return (size_t)((uintptr_t)cp - (uintptr_t)str); | ||
| 107 | } | ||
| 108 | #endif | ||
| 109 | -- | ||
| 110 | 2.17.1 | ||
| 111 | |||
diff --git a/meta/recipes-connectivity/openssh/openssh_9.7p1.bb b/meta/recipes-connectivity/openssh/openssh_9.7p1.bb index 4a08c0bd66..4f20616295 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.7p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.7p1.bb | |||
| @@ -22,7 +22,6 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar | |||
| 22 | file://sshdgenkeys.service \ | 22 | file://sshdgenkeys.service \ |
| 23 | file://volatiles.99_sshd \ | 23 | file://volatiles.99_sshd \ |
| 24 | file://run-ptest \ | 24 | file://run-ptest \ |
| 25 | file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \ | ||
| 26 | file://sshd_check_keys \ | 25 | file://sshd_check_keys \ |
| 27 | file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \ | 26 | file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \ |
| 28 | file://0001-systemd-Add-optional-support-for-systemd-sd_notify.patch \ | 27 | file://0001-systemd-Add-optional-support-for-systemd-sd_notify.patch \ |
