From d59af70fe0252123fa7e743b44eb494390bce97d Mon Sep 17 00:00:00 2001 From: yixiangzhike Date: Thu, 19 Dec 2024 17:06:48 +0800 Subject: [PATCH] Fix heap corruption (cherry picked from commit a72252649ca3669d516425d11ceb1bb4c1494c57) --- backport-Fix-heap-corruption.patch | 33 ++++++++++++++++++++++++++++++ cyrus-sasl.spec | 6 +++++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 backport-Fix-heap-corruption.patch diff --git a/backport-Fix-heap-corruption.patch b/backport-Fix-heap-corruption.patch new file mode 100644 index 0000000..a6b27a1 --- /dev/null +++ b/backport-Fix-heap-corruption.patch @@ -0,0 +1,33 @@ +From e04a67610adeea29541078cbc9e0cf9dab659e6b Mon Sep 17 00:00:00 2001 +From: Guido Kiener +Date: Fri, 1 Dec 2023 16:19:27 +0100 +Subject: [PATCH] Fix heap corruption + +Calculation of resultlen is wrong. E.g. if server allows +only one mechanism SCRAM-SHA-256, the expected string for the +mechlist_buf is "SCRAM-SHA-256-PLUS SCRAM-SHA-256" with a required +size of 33 bytes and not 32 bytes. +Note that (strlen(mysep) * (s_conn->mech_length - 1) * 2) = 0 +when s_conn->mech_length = 1. + +Signed-off-by: Guido Kiener +--- + lib/server.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/server.c b/lib/server.c +index c69e58b8..b44155f4 100644 +--- a/lib/server.c ++++ b/lib/server.c +@@ -1764,7 +1764,7 @@ int _sasl_server_listmech(sasl_conn_t *conn, + INTERROR(conn, SASL_NOMECH); + + resultlen = (prefix ? strlen(prefix) : 0) +- + (strlen(mysep) * (s_conn->mech_length - 1) * 2) ++ + (strlen(mysep) * (s_conn->mech_length * 2 - 1)) + + (mech_names_len(s_conn->mech_list) * 2) /* including -PLUS variant */ + + (s_conn->mech_length * (sizeof("-PLUS") - 1)) + + (suffix ? strlen(suffix) : 0) +-- +2.33.0 + diff --git a/cyrus-sasl.spec b/cyrus-sasl.spec index 3a4fed0..6d9c5e2 100644 --- a/cyrus-sasl.spec +++ b/cyrus-sasl.spec @@ -6,7 +6,7 @@ Name: cyrus-sasl Version: 2.1.28 -Release: 4 +Release: 5 Summary: The Cyrus SASL API Implementation License: BSD with advertising @@ -19,6 +19,7 @@ Patch1: backport-Fix-earlier-554-commit-to-use-fetch_errno-instead-of.patch Patch2: backport-sample-Rename-dprint-function.patch Patch3: backport-Fix-time.h-check.patch Patch4: backport-Use-int-instead-of-char-for-variable-c.patch +Patch5: backport-Fix-heap-corruption.patch BuildRequires: autoconf, automake, libtool, gdbm-devel, groff BuildRequires: krb5-devel >= 1.2.2, openssl-devel, pam-devel, pkgconfig @@ -261,6 +262,9 @@ getent passwd %{username} >/dev/null || useradd -r -g %{username} -d %{homedir} %changelog +* Thu Dec 19 2024 yixiangzhike - 2.1.28-5 +- backport upstream patch to fix heap corruption + * Fri Oct 11 2024 yixiangzhike - 2.1.28-4 - backport upstream patch to fix char overflow -- Gitee