microsoft
/
CBL-Mariner
зеркало из https://github.com/microsoft/CBL-Mariner.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

glibc: patch CVE-2019-25013 (#522) 

Co-authored-by: nicolasg@microsoft.com <nicolasg@microsoft.com>
This commit is contained in:
nicolas guibourge 2021-01-08 10:04:10 -08:00 коммит произвёл GitHub
Родитель f243094bba
Коммит eaf285b7d2
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
6 изменённых файлов: 165 добавлений и 29 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

132
SPECS/glibc/CVE-2019-25013.patch Normal file
Просмотреть файл

@ -0,0 +1,132 @@
From ee7a3144c9922808181009b7b3e50e852fb4999b Mon Sep 17 00:00:00 2001
From: Andreas Schwab <schwab@suse.de>
Date: Mon, 21 Dec 2020 08:56:43 +0530
Subject: [PATCH] Fix buffer overrun in EUC-KR conversion module (bz #24973)
The byte 0xfe as input to the EUC-KR conversion denotes a user-defined
area and is not allowed. The from_euc_kr function used to skip two bytes
when told to skip over the unknown designation, potentially running over
the buffer end.
---
iconvdata/Makefile | 3 ++-
iconvdata/bug-iconv13.c | 53 +++++++++++++++++++++++++++++++++++++++++
iconvdata/euc-kr.c | 6 +----
iconvdata/ksc5601.h | 6 ++---
4 files changed, 59 insertions(+), 9 deletions(-)
create mode 100644 iconvdata/bug-iconv13.c
diff --git a/iconvdata/Makefile b/iconvdata/Makefile
index 4ec2741cdc..85009f3390 100644
--- a/iconvdata/Makefile
+++ b/iconvdata/Makefile
@@ -73,7 +73,8 @@ modules.so := $(addsuffix .so, $(modules))
ifeq (yes,$(build-shared))
tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \
tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \
- bug-iconv10 bug-iconv11 bug-iconv12
+ bug-iconv10 bug-iconv11 bug-iconv12 \
+ bug-iconv13
ifeq ($(have-thread-library),yes)
tests += bug-iconv3
endif
diff --git a/iconvdata/bug-iconv13.c b/iconvdata/bug-iconv13.c
new file mode 100644
index 0000000000..87aaff398e
--- /dev/null
+++ b/iconvdata/bug-iconv13.c
@@ -0,0 +1,53 @@
+/* bug 24973: Test EUC-KR module
+ Copyright (C) 2020 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <https://www.gnu.org/licenses/>. */
+
+#include <errno.h>
+#include <iconv.h>
+#include <stdio.h>
+#include <support/check.h>
+
+static int
+do_test (void)
+{
+ iconv_t cd = iconv_open ("UTF-8//IGNORE", "EUC-KR");
+ TEST_VERIFY_EXIT (cd != (iconv_t) -1);
+
+ /* 0xfe (->0x7e : row 94) and 0xc9 (->0x49 : row 41) are user-defined
+ areas, which are not allowed and should be skipped over due to
+ //IGNORE. The trailing 0xfe also is an incomplete sequence, which
+ should be checked first. */
+ char input[4] = { '\xc9', '\xa1', '\0', '\xfe' };
+ char *inptr = input;
+ size_t insize = sizeof (input);
+ char output[4];
+ char *outptr = output;
+ size_t outsize = sizeof (output);
+
+ /* This used to crash due to buffer overrun. */
+ TEST_VERIFY (iconv (cd, &inptr, &insize, &outptr, &outsize) == (size_t) -1);
+ TEST_VERIFY (errno == EINVAL);
+ /* The conversion should produce one character, the converted null
+ character. */
+ TEST_VERIFY (sizeof (output) - outsize == 1);
+
+ TEST_VERIFY_EXIT (iconv_close (cd) != -1);
+
+ return 0;
+}
+
+#include <support/test-driver.c>
diff --git a/iconvdata/euc-kr.c b/iconvdata/euc-kr.c
index b0d56cf3ee..1045bae926 100644
--- a/iconvdata/euc-kr.c
+++ b/iconvdata/euc-kr.c
@@ -80,11 +80,7 @@ euckr_from_ucs4 (uint32_t ch, unsigned char *cp)
\
if (ch <= 0x9f) \
++inptr; \
- /* 0xfe(->0x7e : row 94) and 0xc9(->0x59 : row 41) are \
- user-defined areas. */ \
- else if (__builtin_expect (ch == 0xa0, 0) \
- || __builtin_expect (ch > 0xfe, 0) \
- || __builtin_expect (ch == 0xc9, 0)) \
+ else if (__glibc_unlikely (ch == 0xa0)) \
{ \
/* This is illegal. */ \
STANDARD_FROM_LOOP_ERR_HANDLER (1); \
diff --git a/iconvdata/ksc5601.h b/iconvdata/ksc5601.h
index d3eb3a4ff8..f5cdc72797 100644
--- a/iconvdata/ksc5601.h
+++ b/iconvdata/ksc5601.h
@@ -50,15 +50,15 @@ ksc5601_to_ucs4 (const unsigned char **s, size_t avail, unsigned char offset)
unsigned char ch2;
int idx;
+ if (avail < 2)
+ return 0;
+
/* row 94(0x7e) and row 41(0x49) are user-defined area in KS C 5601 */
if (ch < offset || (ch - offset) <= 0x20 || (ch - offset) >= 0x7e
|| (ch - offset) == 0x49)
return __UNKNOWN_10646_CHAR;
- if (avail < 2)
- return 0;
-
ch2 = (*s)[1];
if (ch2 < offset || (ch2 - offset) <= 0x20 || (ch2 - offset) >= 0x7f)
return __UNKNOWN_10646_CHAR;
--
2.27.0

6
SPECS/glibc/glibc.spec
Просмотреть файл

@ -6,7 +6,7 @@
Summary: Main C library
Name: glibc
Version: 2.28
Release: 15%{?dist}
Release: 16%{?dist}
License: LGPLv2+
Vendor: Microsoft Corporation
Distribution: Mariner
@ -35,6 +35,7 @@ Patch11: CVE-2018-20796.nopatch
Patch12: CVE-2019-7309.patch
# CVE-2019-19126 patch taken from upstream commit 7966ce07e89fa4ccc8fdba00d4439fc652862462
Patch13: CVE-2019-19126.patch
Patch14: CVE-2019-25013.patch
Requires: filesystem
Provides: rtld(GNU_HASH)
Provides: /sbin/ldconfig
@ -306,6 +307,9 @@ grep "^FAIL: nptl/tst-eintr1" tests.sum >/dev/null && n=$((n+1)) ||:
%defattr(-,root,root)
%changelog
* Fri Jan 08 2021 Nicolas guibourge <nicolasg@microsoft.com> - 2.28-16
- Patch CVE-2019-25013
* Mon Dec 07 2020 Mateusz Malisz <mamalisz@microsoft.com> - 2.28-15
- Exclude binaries(such as bash) from requires list.

14
toolkit/resources/manifests/package/pkggen_core_aarch64.txt
Просмотреть файл

@ -1,12 +1,12 @@
filesystem-1.1-7.cm1.aarch64.rpm
kernel-headers-5.4.83-2.cm1.noarch.rpm
glibc-2.28-15.cm1.aarch64.rpm
glibc-devel-2.28-15.cm1.aarch64.rpm
glibc-i18n-2.28-15.cm1.aarch64.rpm
glibc-iconv-2.28-15.cm1.aarch64.rpm
glibc-lang-2.28-15.cm1.aarch64.rpm
glibc-nscd-2.28-15.cm1.aarch64.rpm
glibc-tools-2.28-15.cm1.aarch64.rpm
glibc-2.28-16.cm1.aarch64.rpm
glibc-devel-2.28-16.cm1.aarch64.rpm
glibc-i18n-2.28-16.cm1.aarch64.rpm
glibc-iconv-2.28-16.cm1.aarch64.rpm
glibc-lang-2.28-16.cm1.aarch64.rpm
glibc-nscd-2.28-16.cm1.aarch64.rpm
glibc-tools-2.28-16.cm1.aarch64.rpm
zlib-1.2.11-3.cm1.aarch64.rpm
zlib-devel-1.2.11-3.cm1.aarch64.rpm
file-5.38-1.cm1.aarch64.rpm

14
toolkit/resources/manifests/package/pkggen_core_x86_64.txt
Просмотреть файл

@ -1,12 +1,12 @@
filesystem-1.1-7.cm1.x86_64.rpm
kernel-headers-5.4.83-2.cm1.noarch.rpm
glibc-2.28-15.cm1.x86_64.rpm
glibc-devel-2.28-15.cm1.x86_64.rpm
glibc-i18n-2.28-15.cm1.x86_64.rpm
glibc-iconv-2.28-15.cm1.x86_64.rpm
glibc-lang-2.28-15.cm1.x86_64.rpm
glibc-nscd-2.28-15.cm1.x86_64.rpm
glibc-tools-2.28-15.cm1.x86_64.rpm
glibc-2.28-16.cm1.x86_64.rpm
glibc-devel-2.28-16.cm1.x86_64.rpm
glibc-i18n-2.28-16.cm1.x86_64.rpm
glibc-iconv-2.28-16.cm1.x86_64.rpm
glibc-lang-2.28-16.cm1.x86_64.rpm
glibc-nscd-2.28-16.cm1.x86_64.rpm
glibc-tools-2.28-16.cm1.x86_64.rpm
zlib-1.2.11-3.cm1.x86_64.rpm
zlib-devel-1.2.11-3.cm1.x86_64.rpm
file-5.38-1.cm1.x86_64.rpm

14
toolkit/resources/manifests/package/toolchain_aarch64.txt
Просмотреть файл

@ -104,13 +104,13 @@ gettext-0.19.8.1-3.cm1.aarch64.rpm
gettext-debuginfo-0.19.8.1-3.cm1.aarch64.rpm
gfortran-9.1.0-7.cm1.aarch64.rpm
glib-2.58.0-7.cm1.aarch64.rpm
glibc-2.28-15.cm1.aarch64.rpm
glibc-devel-2.28-15.cm1.aarch64.rpm
glibc-i18n-2.28-15.cm1.aarch64.rpm
glibc-iconv-2.28-15.cm1.aarch64.rpm
glibc-lang-2.28-15.cm1.aarch64.rpm
glibc-nscd-2.28-15.cm1.aarch64.rpm
glibc-tools-2.28-15.cm1.aarch64.rpm
glibc-2.28-16.cm1.aarch64.rpm
glibc-devel-2.28-16.cm1.aarch64.rpm
glibc-i18n-2.28-16.cm1.aarch64.rpm
glibc-iconv-2.28-16.cm1.aarch64.rpm
glibc-lang-2.28-16.cm1.aarch64.rpm
glibc-nscd-2.28-16.cm1.aarch64.rpm
glibc-tools-2.28-16.cm1.aarch64.rpm
glib-debuginfo-2.58.0-7.cm1.aarch64.rpm
glib-devel-2.58.0-7.cm1.aarch64.rpm
glib-schemas-2.58.0-7.cm1.aarch64.rpm

14
toolkit/resources/manifests/package/toolchain_x86_64.txt
Просмотреть файл

@ -104,13 +104,13 @@ gettext-0.19.8.1-3.cm1.x86_64.rpm
gettext-debuginfo-0.19.8.1-3.cm1.x86_64.rpm
gfortran-9.1.0-7.cm1.x86_64.rpm
glib-2.58.0-7.cm1.x86_64.rpm
glibc-2.28-15.cm1.x86_64.rpm
glibc-devel-2.28-15.cm1.x86_64.rpm
glibc-i18n-2.28-15.cm1.x86_64.rpm
glibc-iconv-2.28-15.cm1.x86_64.rpm
glibc-lang-2.28-15.cm1.x86_64.rpm
glibc-nscd-2.28-15.cm1.x86_64.rpm
glibc-tools-2.28-15.cm1.x86_64.rpm
glibc-2.28-16.cm1.x86_64.rpm
glibc-devel-2.28-16.cm1.x86_64.rpm
glibc-i18n-2.28-16.cm1.x86_64.rpm
glibc-iconv-2.28-16.cm1.x86_64.rpm
glibc-lang-2.28-16.cm1.x86_64.rpm
glibc-nscd-2.28-16.cm1.x86_64.rpm
glibc-tools-2.28-16.cm1.x86_64.rpm
glib-debuginfo-2.58.0-7.cm1.x86_64.rpm
glib-devel-2.58.0-7.cm1.x86_64.rpm
glib-schemas-2.58.0-7.cm1.x86_64.rpm