fix CVE-2022-23218 and CVE-2022-23219
This commit is contained in:
liqingqing_1229
parent
a0ed1a9a57
commit
c6eb2400b0
125
CVE-2022-23218-Buffer-overflow-in-sunrpc-svcunix_cre.patch
Normal file
125
CVE-2022-23218-Buffer-overflow-in-sunrpc-svcunix_cre.patch
Normal file
@ -0,0 +1,125 @@
|
|||||||
|
From f545ad4928fa1f27a3075265182b38a4f939a5f7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Florian Weimer <fweimer@redhat.com>
|
||||||
|
Date: Mon, 17 Jan 2022 10:21:34 +0100
|
||||||
|
Subject: [PATCH] CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug
|
||||||
|
28768)
|
||||||
|
|
||||||
|
The sunrpc function svcunix_create suffers from a stack-based buffer
|
||||||
|
overflow with overlong pathname arguments.
|
||||||
|
|
||||||
|
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
|
||||||
|
---
|
||||||
|
NEWS | 3 +++
|
||||||
|
sunrpc/Makefile | 2 +-
|
||||||
|
sunrpc/svc_unix.c | 11 ++++-------
|
||||||
|
sunrpc/tst-bug28768.c | 42 ++++++++++++++++++++++++++++++++++++++++++
|
||||||
|
4 files changed, 50 insertions(+), 8 deletions(-)
|
||||||
|
create mode 100644 sunrpc/tst-bug28768.c
|
||||||
|
|
||||||
|
diff --git a/NEWS b/NEWS
|
||||||
|
index 38a9ddb..38802f0 100644
|
||||||
|
--- a/NEWS
|
||||||
|
+++ b/NEWS
|
||||||
|
@@ -14,6 +14,9 @@ Security related changes:
|
||||||
|
legacy function could result in a stack-based buffer overflow when
|
||||||
|
using the "unix" protocol. Reported by Martin Sebor.
|
||||||
|
|
||||||
|
+ CVE-2022-23218: Passing an overlong file name to the svcunix_create
|
||||||
|
+ legacy function could result in a stack-based buffer overflow.
|
||||||
|
+
|
||||||
|
The following bugs are resolved with this release:
|
||||||
|
|
||||||
|
[22542] CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix"
|
||||||
|
diff --git a/sunrpc/Makefile b/sunrpc/Makefile
|
||||||
|
index 183ef3d..a79a719 100644
|
||||||
|
--- a/sunrpc/Makefile
|
||||||
|
+++ b/sunrpc/Makefile
|
||||||
|
@@ -65,7 +65,7 @@ shared-only-routines = $(routines)
|
||||||
|
endif
|
||||||
|
|
||||||
|
tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-udp-error tst-udp-timeout \
|
||||||
|
- tst-udp-nonblocking tst-bug22542
|
||||||
|
+ tst-udp-nonblocking tst-bug22542 tst-bug28768
|
||||||
|
|
||||||
|
xtests := tst-getmyaddr
|
||||||
|
|
||||||
|
diff --git a/sunrpc/svc_unix.c b/sunrpc/svc_unix.c
|
||||||
|
index f2280b4..67177a2 100644
|
||||||
|
--- a/sunrpc/svc_unix.c
|
||||||
|
+++ b/sunrpc/svc_unix.c
|
||||||
|
@@ -154,7 +154,10 @@ svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path)
|
||||||
|
SVCXPRT *xprt;
|
||||||
|
struct unix_rendezvous *r;
|
||||||
|
struct sockaddr_un addr;
|
||||||
|
- socklen_t len = sizeof (struct sockaddr_in);
|
||||||
|
+ socklen_t len = sizeof (addr);
|
||||||
|
+
|
||||||
|
+ if (__sockaddr_un_set (&addr, path) < 0)
|
||||||
|
+ return NULL;
|
||||||
|
|
||||||
|
if (sock == RPC_ANYSOCK)
|
||||||
|
{
|
||||||
|
@@ -165,12 +168,6 @@ svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path)
|
||||||
|
}
|
||||||
|
madesock = TRUE;
|
||||||
|
}
|
||||||
|
- memset (&addr, '\0', sizeof (addr));
|
||||||
|
- addr.sun_family = AF_UNIX;
|
||||||
|
- len = strlen (path) + 1;
|
||||||
|
- memcpy (addr.sun_path, path, len);
|
||||||
|
- len += sizeof (addr.sun_family);
|
||||||
|
-
|
||||||
|
__bind (sock, (struct sockaddr *) &addr, len);
|
||||||
|
|
||||||
|
if (__getsockname (sock, (struct sockaddr *) &addr, &len) != 0
|
||||||
|
diff --git a/sunrpc/tst-bug28768.c b/sunrpc/tst-bug28768.c
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..35a4b7b
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/sunrpc/tst-bug28768.c
|
||||||
|
@@ -0,0 +1,42 @@
|
||||||
|
+/* Test to verify that long path is rejected by svcunix_create (bug 28768).
|
||||||
|
+ Copyright (C) 2022 Free Software Foundation, Inc.
|
||||||
|
+ This file is part of the GNU C Library.
|
||||||
|
+
|
||||||
|
+ The GNU C Library is free software; you can redistribute it and/or
|
||||||
|
+ modify it under the terms of the GNU Lesser General Public
|
||||||
|
+ License as published by the Free Software Foundation; either
|
||||||
|
+ version 2.1 of the License, or (at your option) any later version.
|
||||||
|
+
|
||||||
|
+ The GNU C Library is distributed in the hope that it will be useful,
|
||||||
|
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
|
+ Lesser General Public License for more details.
|
||||||
|
+
|
||||||
|
+ You should have received a copy of the GNU Lesser General Public
|
||||||
|
+ License along with the GNU C Library; if not, see
|
||||||
|
+ <http://www.gnu.org/licenses/>. */
|
||||||
|
+
|
||||||
|
+#include <errno.h>
|
||||||
|
+#include <rpc/svc.h>
|
||||||
|
+#include <shlib-compat.h>
|
||||||
|
+#include <string.h>
|
||||||
|
+#include <support/check.h>
|
||||||
|
+
|
||||||
|
+/* svcunix_create does not have a default version in linkobj/libc.so. */
|
||||||
|
+compat_symbol_reference (libc, svcunix_create, svcunix_create, GLIBC_2_1);
|
||||||
|
+
|
||||||
|
+static int
|
||||||
|
+do_test (void)
|
||||||
|
+{
|
||||||
|
+ char pathname[109];
|
||||||
|
+ memset (pathname, 'x', sizeof (pathname));
|
||||||
|
+ pathname[sizeof (pathname) - 1] = '\0';
|
||||||
|
+
|
||||||
|
+ errno = 0;
|
||||||
|
+ TEST_VERIFY (svcunix_create (RPC_ANYSOCK, 4096, 4096, pathname) == NULL);
|
||||||
|
+ TEST_COMPARE (errno, EINVAL);
|
||||||
|
+
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+#include <support/test-driver.c>
|
||||||
|
--
|
||||||
|
1.8.3.1
|
||||||
|
|
||||||
65
CVE-2022-23219-Buffer-overflow-in-sunrpc-clnt_create.patch
Normal file
65
CVE-2022-23219-Buffer-overflow-in-sunrpc-clnt_create.patch
Normal file
@ -0,0 +1,65 @@
|
|||||||
|
From 226b46770c82899b555986583294b049c6ec9b40 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Florian Weimer <fweimer@redhat.com>
|
||||||
|
Date: Mon, 17 Jan 2022 10:21:34 +0100
|
||||||
|
Subject: [PATCH] CVE-2022-23219: Buffer overflow in sunrpc clnt_create for
|
||||||
|
"unix" (bug 22542)
|
||||||
|
|
||||||
|
Processing an overlong pathname in the sunrpc clnt_create function
|
||||||
|
results in a stack-based buffer overflow.
|
||||||
|
|
||||||
|
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
|
||||||
|
|
||||||
|
---
|
||||||
|
NEWS | 14 ++++++++++++++
|
||||||
|
sunrpc/clnt_gen.c | 10 +++++++---
|
||||||
|
2 files changed, 21 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/NEWS b/NEWS
|
||||||
|
index 3c610744..dbe6f086 100644
|
||||||
|
--- a/NEWS
|
||||||
|
+++ b/NEWS
|
||||||
|
@@ -4,6 +4,20 @@ See the end for copying conditions.
|
||||||
|
|
||||||
|
Please send GNU C library bug reports via <https://sourceware.org/bugzilla/>
|
||||||
|
using `glibc' in the "product" field.
|
||||||
|
+
|
||||||
|
+^L
|
||||||
|
+Version 2.34.1
|
||||||
|
+
|
||||||
|
+Security related changes:
|
||||||
|
+
|
||||||
|
+ CVE-2022-23219: Passing an overlong file name to the clnt_create
|
||||||
|
+ legacy function could result in a stack-based buffer overflow when
|
||||||
|
+ using the "unix" protocol. Reported by Martin Sebor.
|
||||||
|
+
|
||||||
|
+The following bugs are resolved with this release:
|
||||||
|
+
|
||||||
|
+ [22542] CVE-2022-23219: Buffer overflow in sunrpc clnt_create for "unix"
|
||||||
|
+
|
||||||
|
|
||||||
|
Version 2.34
|
||||||
|
|
||||||
|
diff --git a/sunrpc/clnt_gen.c b/sunrpc/clnt_gen.c
|
||||||
|
index 13ced899..b44357cd 100644
|
||||||
|
--- a/sunrpc/clnt_gen.c
|
||||||
|
+++ b/sunrpc/clnt_gen.c
|
||||||
|
@@ -57,9 +57,13 @@ clnt_create (const char *hostname, u_long prog, u_long vers,
|
||||||
|
|
||||||
|
if (strcmp (proto, "unix") == 0)
|
||||||
|
{
|
||||||
|
- memset ((char *)&sun, 0, sizeof (sun));
|
||||||
|
- sun.sun_family = AF_UNIX;
|
||||||
|
- strcpy (sun.sun_path, hostname);
|
||||||
|
+ if (__sockaddr_un_set (&sun, hostname) < 0)
|
||||||
|
+ {
|
||||||
|
+ struct rpc_createerr *ce = &get_rpc_createerr ();
|
||||||
|
+ ce->cf_stat = RPC_SYSTEMERROR;
|
||||||
|
+ ce->cf_error.re_errno = errno;
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
sock = RPC_ANYSOCK;
|
||||||
|
client = clntunix_create (&sun, prog, vers, &sock, 0, 0);
|
||||||
|
if (client == NULL)
|
||||||
|
--
|
||||||
|
2.27.0
|
||||||
|
|
||||||
@ -66,7 +66,7 @@
|
|||||||
##############################################################################
|
##############################################################################
|
||||||
Name: glibc
|
Name: glibc
|
||||||
Version: 2.34
|
Version: 2.34
|
||||||
Release: 42
|
Release: 43
|
||||||
Summary: The GNU libc libraries
|
Summary: The GNU libc libraries
|
||||||
License: %{all_license}
|
License: %{all_license}
|
||||||
URL: http://www.gnu.org/software/glibc/
|
URL: http://www.gnu.org/software/glibc/
|
||||||
@ -159,6 +159,10 @@ Patch71: AArch64-Check-for-SVE-in-ifuncs-BZ-28744.patch
|
|||||||
Patch72: Fix-subscript-error-with-odd-TZif-file-BZ-28338.patch
|
Patch72: Fix-subscript-error-with-odd-TZif-file-BZ-28338.patch
|
||||||
Patch73: timezone-handle-truncated-timezones-from-tzcode-2021.patch
|
Patch73: timezone-handle-truncated-timezones-from-tzcode-2021.patch
|
||||||
Patch74: timezone-test-case-for-BZ-28707.patch
|
Patch74: timezone-test-case-for-BZ-28707.patch
|
||||||
|
Patch75: socket-Add-the-__sockaddr_un_set-function.patch
|
||||||
|
Patch76: CVE-2022-23219-Buffer-overflow-in-sunrpc-clnt_create.patch
|
||||||
|
Patch77: sunrpc-Test-case-for-clnt_create-unix-buffer-overflo.patch
|
||||||
|
Patch78: CVE-2022-23218-Buffer-overflow-in-sunrpc-svcunix_cre.patch
|
||||||
|
|
||||||
Patch9000: turn-default-value-of-x86_rep_stosb_threshold_form_2K_to_1M.patch
|
Patch9000: turn-default-value-of-x86_rep_stosb_threshold_form_2K_to_1M.patch
|
||||||
Patch9001: delete-no-hard-link-to-avoid-all_language-package-to.patch
|
Patch9001: delete-no-hard-link-to-avoid-all_language-package-to.patch
|
||||||
@ -1361,6 +1365,9 @@ fi
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
*Tue Jan 18 Qingqing Li <liqingqing3@huawei.com> - 2.34-43
|
||||||
|
- fix CVE-2022-23218 and CVE-2022-23219
|
||||||
|
|
||||||
* Tue Jan 11 2022 Yang Yanchao <yangyanchao6@huawei.com> - 2.34-42
|
* Tue Jan 11 2022 Yang Yanchao <yangyanchao6@huawei.com> - 2.34-42
|
||||||
- delete macro __filter_GLIBC_PRIVATE which is not support in rpm-4.17
|
- delete macro __filter_GLIBC_PRIVATE which is not support in rpm-4.17
|
||||||
Use arbitrary filtering to control GLIBC_PRIVATE
|
Use arbitrary filtering to control GLIBC_PRIVATE
|
||||||
|
|||||||
174
socket-Add-the-__sockaddr_un_set-function.patch
Normal file
174
socket-Add-the-__sockaddr_un_set-function.patch
Normal file
@ -0,0 +1,174 @@
|
|||||||
|
From e368b12f6c16b6888dda99ba641e999b9c9643c8 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Florian Weimer <fweimer@redhat.com>
|
||||||
|
Date: Mon, 17 Jan 2022 10:21:34 +0100
|
||||||
|
Subject: [PATCH] socket: Add the __sockaddr_un_set function
|
||||||
|
|
||||||
|
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
|
||||||
|
---
|
||||||
|
include/sys/un.h | 12 +++++++++
|
||||||
|
socket/Makefile | 6 ++++-
|
||||||
|
socket/sockaddr_un_set.c | 41 +++++++++++++++++++++++++++++
|
||||||
|
socket/tst-sockaddr_un_set.c | 62 ++++++++++++++++++++++++++++++++++++++++++++
|
||||||
|
4 files changed, 120 insertions(+), 1 deletion(-)
|
||||||
|
create mode 100644 socket/sockaddr_un_set.c
|
||||||
|
create mode 100644 socket/tst-sockaddr_un_set.c
|
||||||
|
|
||||||
|
diff --git a/include/sys/un.h b/include/sys/un.h
|
||||||
|
index bdbee99..152afd9 100644
|
||||||
|
--- a/include/sys/un.h
|
||||||
|
+++ b/include/sys/un.h
|
||||||
|
@@ -1 +1,13 @@
|
||||||
|
#include <socket/sys/un.h>
|
||||||
|
+
|
||||||
|
+#ifndef _ISOMAC
|
||||||
|
+
|
||||||
|
+/* Set ADDR->sun_family to AF_UNIX and ADDR->sun_path to PATHNAME.
|
||||||
|
+ Return 0 on success or -1 on failure (due to overlong PATHNAME).
|
||||||
|
+ The caller should always use sizeof (struct sockaddr_un) as the
|
||||||
|
+ socket address length, disregaring the length of PATHNAME.
|
||||||
|
+ Only concrete (non-abstract) pathnames are supported. */
|
||||||
|
+int __sockaddr_un_set (struct sockaddr_un *addr, const char *pathname)
|
||||||
|
+ attribute_hidden;
|
||||||
|
+
|
||||||
|
+#endif /* _ISOMAC */
|
||||||
|
diff --git a/socket/Makefile b/socket/Makefile
|
||||||
|
index 39333e1..156eec6 100644
|
||||||
|
--- a/socket/Makefile
|
||||||
|
+++ b/socket/Makefile
|
||||||
|
@@ -29,13 +29,17 @@ headers := sys/socket.h sys/un.h bits/sockaddr.h bits/socket.h \
|
||||||
|
routines := accept bind connect getpeername getsockname getsockopt \
|
||||||
|
listen recv recvfrom recvmsg send sendmsg sendto \
|
||||||
|
setsockopt shutdown socket socketpair isfdtype opensock \
|
||||||
|
- sockatmark accept4 recvmmsg sendmmsg
|
||||||
|
+ sockatmark accept4 recvmmsg sendmmsg sockaddr_un_set
|
||||||
|
|
||||||
|
tests := \
|
||||||
|
tst-accept4 \
|
||||||
|
tst-sockopt \
|
||||||
|
# tests
|
||||||
|
|
||||||
|
+tests-internal := \
|
||||||
|
+ tst-sockaddr_un_set \
|
||||||
|
+ # tests-internal
|
||||||
|
+
|
||||||
|
tests-time64 := \
|
||||||
|
tst-sockopt-time64 \
|
||||||
|
# tests
|
||||||
|
diff --git a/socket/sockaddr_un_set.c b/socket/sockaddr_un_set.c
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..0bd40dc
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/socket/sockaddr_un_set.c
|
||||||
|
@@ -0,0 +1,41 @@
|
||||||
|
+/* Set the sun_path member of struct sockaddr_un.
|
||||||
|
+ Copyright (C) 2022 Free Software Foundation, Inc.
|
||||||
|
+ This file is part of the GNU C Library.
|
||||||
|
+
|
||||||
|
+ The GNU C Library is free software; you can redistribute it and/or
|
||||||
|
+ modify it under the terms of the GNU Lesser General Public
|
||||||
|
+ License as published by the Free Software Foundation; either
|
||||||
|
+ version 2.1 of the License, or (at your option) any later version.
|
||||||
|
+
|
||||||
|
+ The GNU C Library is distributed in the hope that it will be useful,
|
||||||
|
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
|
+ Lesser General Public License for more details.
|
||||||
|
+
|
||||||
|
+ You should have received a copy of the GNU Lesser General Public
|
||||||
|
+ License along with the GNU C Library; if not, see
|
||||||
|
+ <https://www.gnu.org/licenses/>. */
|
||||||
|
+
|
||||||
|
+#include <errno.h>
|
||||||
|
+#include <string.h>
|
||||||
|
+#include <sys/socket.h>
|
||||||
|
+#include <sys/un.h>
|
||||||
|
+
|
||||||
|
+int
|
||||||
|
+__sockaddr_un_set (struct sockaddr_un *addr, const char *pathname)
|
||||||
|
+{
|
||||||
|
+ size_t name_length = strlen (pathname);
|
||||||
|
+
|
||||||
|
+ /* The kernel supports names of exactly sizeof (addr->sun_path)
|
||||||
|
+ bytes, without a null terminator, but userspace does not; see the
|
||||||
|
+ SUN_LEN macro. */
|
||||||
|
+ if (name_length >= sizeof (addr->sun_path))
|
||||||
|
+ {
|
||||||
|
+ __set_errno (EINVAL); /* Error code used by the kernel. */
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ addr->sun_family = AF_UNIX;
|
||||||
|
+ memcpy (addr->sun_path, pathname, name_length + 1);
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
diff --git a/socket/tst-sockaddr_un_set.c b/socket/tst-sockaddr_un_set.c
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..29c2a81
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/socket/tst-sockaddr_un_set.c
|
||||||
|
@@ -0,0 +1,62 @@
|
||||||
|
+/* Test the __sockaddr_un_set function.
|
||||||
|
+ Copyright (C) 2022 Free Software Foundation, Inc.
|
||||||
|
+ This file is part of the GNU C Library.
|
||||||
|
+
|
||||||
|
+ The GNU C Library is free software; you can redistribute it and/or
|
||||||
|
+ modify it under the terms of the GNU Lesser General Public
|
||||||
|
+ License as published by the Free Software Foundation; either
|
||||||
|
+ version 2.1 of the License, or (at your option) any later version.
|
||||||
|
+
|
||||||
|
+ The GNU C Library is distributed in the hope that it will be useful,
|
||||||
|
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
|
+ Lesser General Public License for more details.
|
||||||
|
+
|
||||||
|
+ You should have received a copy of the GNU Lesser General Public
|
||||||
|
+ License along with the GNU C Library; if not, see
|
||||||
|
+ <https://www.gnu.org/licenses/>. */
|
||||||
|
+
|
||||||
|
+/* Re-compile the function because the version in libc is not
|
||||||
|
+ exported. */
|
||||||
|
+#include "sockaddr_un_set.c"
|
||||||
|
+
|
||||||
|
+#include <support/check.h>
|
||||||
|
+
|
||||||
|
+static int
|
||||||
|
+do_test (void)
|
||||||
|
+{
|
||||||
|
+ struct sockaddr_un sun;
|
||||||
|
+
|
||||||
|
+ memset (&sun, 0xcc, sizeof (sun));
|
||||||
|
+ __sockaddr_un_set (&sun, "");
|
||||||
|
+ TEST_COMPARE (sun.sun_family, AF_UNIX);
|
||||||
|
+ TEST_COMPARE (__sockaddr_un_set (&sun, ""), 0);
|
||||||
|
+
|
||||||
|
+ memset (&sun, 0xcc, sizeof (sun));
|
||||||
|
+ TEST_COMPARE (__sockaddr_un_set (&sun, "/example"), 0);
|
||||||
|
+ TEST_COMPARE_STRING (sun.sun_path, "/example");
|
||||||
|
+
|
||||||
|
+ {
|
||||||
|
+ char pathname[108]; /* Length of sun_path (ABI constant). */
|
||||||
|
+ memset (pathname, 'x', sizeof (pathname));
|
||||||
|
+ pathname[sizeof (pathname) - 1] = '\0';
|
||||||
|
+ memset (&sun, 0xcc, sizeof (sun));
|
||||||
|
+ TEST_COMPARE (__sockaddr_un_set (&sun, pathname), 0);
|
||||||
|
+ TEST_COMPARE (sun.sun_family, AF_UNIX);
|
||||||
|
+ TEST_COMPARE_STRING (sun.sun_path, pathname);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ {
|
||||||
|
+ char pathname[109];
|
||||||
|
+ memset (pathname, 'x', sizeof (pathname));
|
||||||
|
+ pathname[sizeof (pathname) - 1] = '\0';
|
||||||
|
+ memset (&sun, 0xcc, sizeof (sun));
|
||||||
|
+ errno = 0;
|
||||||
|
+ TEST_COMPARE (__sockaddr_un_set (&sun, pathname), -1);
|
||||||
|
+ TEST_COMPARE (errno, EINVAL);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+#include <support/test-driver.c>
|
||||||
|
--
|
||||||
|
1.8.3.1
|
||||||
|
|
||||||
89
sunrpc-Test-case-for-clnt_create-unix-buffer-overflo.patch
Normal file
89
sunrpc-Test-case-for-clnt_create-unix-buffer-overflo.patch
Normal file
@ -0,0 +1,89 @@
|
|||||||
|
From ef972a4c50014a16132b5c75571cfb6b30bef136 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Martin Sebor <msebor@redhat.com>
|
||||||
|
Date: Mon, 17 Jan 2022 10:21:34 +0100
|
||||||
|
Subject: [PATCH] sunrpc: Test case for clnt_create "unix" buffer overflow (bug
|
||||||
|
22542)
|
||||||
|
|
||||||
|
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
|
||||||
|
---
|
||||||
|
sunrpc/Makefile | 5 ++++-
|
||||||
|
sunrpc/tst-bug22542.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
|
||||||
|
2 files changed, 48 insertions(+), 1 deletion(-)
|
||||||
|
create mode 100644 sunrpc/tst-bug22542.c
|
||||||
|
|
||||||
|
diff --git a/sunrpc/Makefile b/sunrpc/Makefile
|
||||||
|
index 9a31fe4..183ef3d 100644
|
||||||
|
--- a/sunrpc/Makefile
|
||||||
|
+++ b/sunrpc/Makefile
|
||||||
|
@@ -65,7 +65,8 @@ shared-only-routines = $(routines)
|
||||||
|
endif
|
||||||
|
|
||||||
|
tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-udp-error tst-udp-timeout \
|
||||||
|
- tst-udp-nonblocking
|
||||||
|
+ tst-udp-nonblocking tst-bug22542
|
||||||
|
+
|
||||||
|
xtests := tst-getmyaddr
|
||||||
|
|
||||||
|
ifeq ($(have-thread-library),yes)
|
||||||
|
@@ -110,6 +111,8 @@ $(objpfx)tst-udp-nonblocking: $(common-objpfx)linkobj/libc.so
|
||||||
|
$(objpfx)tst-udp-garbage: \
|
||||||
|
$(common-objpfx)linkobj/libc.so $(shared-thread-library)
|
||||||
|
|
||||||
|
+$(objpfx)tst-bug22542: $(common-objpfx)linkobj/libc.so
|
||||||
|
+
|
||||||
|
else # !have-GLIBC_2.31
|
||||||
|
|
||||||
|
routines = $(routines-for-nss)
|
||||||
|
diff --git a/sunrpc/tst-bug22542.c b/sunrpc/tst-bug22542.c
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..d6cd797
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/sunrpc/tst-bug22542.c
|
||||||
|
@@ -0,0 +1,44 @@
|
||||||
|
+/* Test to verify that overlong hostname is rejected by clnt_create
|
||||||
|
+ and doesn't cause a buffer overflow (bug 22542).
|
||||||
|
+
|
||||||
|
+ Copyright (C) 2022 Free Software Foundation, Inc.
|
||||||
|
+ This file is part of the GNU C Library.
|
||||||
|
+
|
||||||
|
+ The GNU C Library is free software; you can redistribute it and/or
|
||||||
|
+ modify it under the terms of the GNU Lesser General Public
|
||||||
|
+ License as published by the Free Software Foundation; either
|
||||||
|
+ version 2.1 of the License, or (at your option) any later version.
|
||||||
|
+
|
||||||
|
+ The GNU C Library is distributed in the hope that it will be useful,
|
||||||
|
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||||
|
+ Lesser General Public License for more details.
|
||||||
|
+
|
||||||
|
+ You should have received a copy of the GNU Lesser General Public
|
||||||
|
+ License along with the GNU C Library; if not, see
|
||||||
|
+ <http://www.gnu.org/licenses/>. */
|
||||||
|
+
|
||||||
|
+#include <errno.h>
|
||||||
|
+#include <rpc/clnt.h>
|
||||||
|
+#include <string.h>
|
||||||
|
+#include <support/check.h>
|
||||||
|
+#include <sys/socket.h>
|
||||||
|
+#include <sys/un.h>
|
||||||
|
+
|
||||||
|
+static int
|
||||||
|
+do_test (void)
|
||||||
|
+{
|
||||||
|
+ /* Create an arbitrary hostname that's longer than fits in sun_path. */
|
||||||
|
+ char name [sizeof ((struct sockaddr_un*)0)->sun_path * 2];
|
||||||
|
+ memset (name, 'x', sizeof name - 1);
|
||||||
|
+ name [sizeof name - 1] = '\0';
|
||||||
|
+
|
||||||
|
+ errno = 0;
|
||||||
|
+ CLIENT *clnt = clnt_create (name, 0, 0, "unix");
|
||||||
|
+
|
||||||
|
+ TEST_VERIFY (clnt == NULL);
|
||||||
|
+ TEST_COMPARE (errno, EINVAL);
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+#include <support/test-driver.c>
|
||||||
|
--
|
||||||
|
1.8.3.1
|
||||||
|
|
||||||
Loading…
x
Reference in New Issue
Block a user