diff --git a/CVE-2022-23218-Buffer-overflow-in-sunrpc-svcunix_cre.patch b/CVE-2022-23218-Buffer-overflow-in-sunrpc-svcunix_cre.patch index 71321de72a1d79c0423f127b4fc16a2dfdcf5aaf..ad883f44b846efc2aae5edc1280e759c80071437 100644 --- a/CVE-2022-23218-Buffer-overflow-in-sunrpc-svcunix_cre.patch +++ b/CVE-2022-23218-Buffer-overflow-in-sunrpc-svcunix_cre.patch @@ -9,24 +9,9 @@ overflow with overlong pathname arguments. Reviewed-by: Siddhesh Poyarekar --- - sunrpc/Makefile | 2 +- sunrpc/svc_unix.c | 11 ++++------- - sunrpc/tst-bug28768.c | 42 ++++++++++++++++++++++++++++++++++++++++++ - 3 files changed, 47 insertions(+), 8 deletions(-) - create mode 100644 sunrpc/tst-bug28768.c - -diff --git a/sunrpc/Makefile b/sunrpc/Makefile -index 183ef3d..a79a719 100644 ---- a/sunrpc/Makefile -+++ b/sunrpc/Makefile -@@ -65,7 +65,7 @@ shared-only-routines = $(routines) - endif - - tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-udp-error tst-udp-timeout \ -- tst-udp-nonblocking tst-bug22542 -+ tst-udp-nonblocking tst-bug22542 tst-bug28768 - - xtests := tst-getmyaddr + 1 files changed, 4 insertions(+), 7 deletions(-) + create mode 100644 sunrpc/svc_unix.c diff --git a/sunrpc/svc_unix.c b/sunrpc/svc_unix.c index f2280b4..67177a2 100644 @@ -57,54 +42,3 @@ index f2280b4..67177a2 100644 __bind (sock, (struct sockaddr *) &addr, len); if (__getsockname (sock, (struct sockaddr *) &addr, &len) != 0 -diff --git a/sunrpc/tst-bug28768.c b/sunrpc/tst-bug28768.c -new file mode 100644 -index 0000000..35a4b7b ---- /dev/null -+++ b/sunrpc/tst-bug28768.c -@@ -0,0 +1,42 @@ -+/* Test to verify that long path is rejected by svcunix_create (bug 28768). -+ Copyright (C) 2022 Free Software Foundation, Inc. -+ This file is part of the GNU C Library. -+ -+ The GNU C Library is free software; you can redistribute it and/or -+ modify it under the terms of the GNU Lesser General Public -+ License as published by the Free Software Foundation; either -+ version 2.1 of the License, or (at your option) any later version. -+ -+ The GNU C Library is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ Lesser General Public License for more details. -+ -+ You should have received a copy of the GNU Lesser General Public -+ License along with the GNU C Library; if not, see -+ . */ -+ -+#include -+#include -+#include -+#include -+#include -+ -+/* svcunix_create does not have a default version in linkobj/libc.so. */ -+compat_symbol_reference (libc, svcunix_create, svcunix_create, GLIBC_2_1); -+ -+static int -+do_test (void) -+{ -+ char pathname[109]; -+ memset (pathname, 'x', sizeof (pathname)); -+ pathname[sizeof (pathname) - 1] = '\0'; -+ -+ errno = 0; -+ TEST_VERIFY (svcunix_create (RPC_ANYSOCK, 4096, 4096, pathname) == NULL); -+ TEST_COMPARE (errno, EINVAL); -+ -+ return 0; -+} -+ -+#include --- -1.8.3.1 - diff --git a/glibc.spec b/glibc.spec index aeec0894be46123481dea1b3617795fa435fc61a..62d1cc0b99ea9f33575c1fef0f93a225b40c9b50 100644 --- a/glibc.spec +++ b/glibc.spec @@ -59,7 +59,7 @@ ############################################################################## Name: glibc Version: 2.28 -Release: 85 +Release: 86 Summary: The GNU libc libraries License: %{all_license} URL: http://www.gnu.org/software/glibc/ @@ -1172,6 +1172,9 @@ fi %doc hesiod/README.hesiod %changelog +* Thu Jan 20 2021 Qingqing Li - 2.28-86 +- sunrpc: fix compile error + * Wed Jan 19 2021 Qingqing Li - 2.28-85 - sunrpc: fix CVE-2022-23218 and fix CVE-2022-23219