From 31aaeeff282cd399c3320c51b70d8dab0dc54c06 Mon Sep 17 00:00:00 2001
From: Sdrkun <shanzhikun@huawewi.com>
Date: Thu, 10 Sep 2020 19:59:31 +0800
Subject: [PATCH] fix CVE-2019-1010023.

---
 Fix-CVE-2019-1010023.patch | 65 ++++++++++++++++++++++++++++++++++++++
 glibc.spec                 |  6 +++-
 2 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 Fix-CVE-2019-1010023.patch

diff --git a/Fix-CVE-2019-1010023.patch b/Fix-CVE-2019-1010023.patch
new file mode 100644
index 0000000..0f6164f
--- /dev/null
+++ b/Fix-CVE-2019-1010023.patch
@@ -0,0 +1,65 @@
+From d44c2d890a989bb67baaf6621858d9e8bde5bbf0 Mon Sep 17 00:00:00 2001
+From: lvying <lvying6@huawei.com>
+Date: Sat, 8 Feb 2020 12:05:36 +0800
+Subject: [PATCH] glibc: fix CVE-2019-1010023
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+| PT_LOAD
+|
+| […] Loadable segment entries in the program header table appear in
+| ascending order, sorted on the p_vaddr member.
+
+http://www.sco.com/developers/gabi/latest/ch5.pheader.html
+
+Some check needed to fix vulnerability in load commands mapping reported by
+
+https://sourceware.org/bugzilla/show_bug.cgi?id=22851
+
+Signed-off-by: lvying <lvying6@huawei.com>
+---
+ elf/dl-map-segments.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/elf/dl-map-segments.h b/elf/dl-map-segments.h
+index 084076a..20dfc5c 100644
+--- a/elf/dl-map-segments.h
++++ b/elf/dl-map-segments.h
+@@ -33,6 +33,7 @@ _dl_map_segments (struct link_map *l, int fd,
+                   struct link_map *loader)
+ {
+   const struct loadcmd *c = loadcmds;
++  ElfW(Addr) l_map_end_aligned;
+ 
+   if (__glibc_likely (type == ET_DYN))
+     {
+@@ -61,6 +62,8 @@ _dl_map_segments (struct link_map *l, int fd,
+         return DL_MAP_SEGMENTS_ERROR_MAP_SEGMENT;
+ 
+       l->l_map_end = l->l_map_start + maplength;
++	  l_map_end_aligned = ((l->l_map_end + GLRO(dl_pagesize) - 1)
++			  & ~(GLRO(dl_pagesize) - 1));
+       l->l_addr = l->l_map_start - c->mapstart;
+ 
+       if (has_holes)
+@@ -85,10 +88,16 @@ _dl_map_segments (struct link_map *l, int fd,
+   /* Remember which part of the address space this object uses.  */
+   l->l_map_start = c->mapstart + l->l_addr;
+   l->l_map_end = l->l_map_start + maplength;
++  l_map_end_aligned = ((l->l_map_end + GLRO(dl_pagesize) - 1)
++		  & ~(GLRO(dl_pagesize) - 1));
+   l->l_contiguous = !has_holes;
+ 
+   while (c < &loadcmds[nloadcmds])
+     {
++		if ((l->l_addr + c->mapend) > l_map_end_aligned ||
++				(l->l_addr + c->mapstart) < l->l_map_start)
++			return DL_MAP_SEGMENTS_ERROR_MAP_SEGMENT;
++
+       if (c->mapend > c->mapstart
+           /* Map the segment contents from the file.  */
+           && (__mmap ((void *) (l->l_addr + c->mapstart),
+-- 
+1.8.3.1
+
diff --git a/glibc.spec b/glibc.spec
index 4a5ee3f..d829e92 100644
--- a/glibc.spec
+++ b/glibc.spec
@@ -59,7 +59,7 @@
 ##############################################################################
 Name: 	 	glibc
 Version: 	2.28
-Release: 	43
+Release: 	44
 Summary: 	The GNU libc libraries
 License:	%{all_license}
 URL: 		http://www.gnu.org/software/glibc/
@@ -90,6 +90,7 @@ Patch13: Fix-double-free-in-__printf_fp_l-bug-26214.patch
 Patch14: Fix-memory-leak-in-__printf_fp_l-bug-26215.patch
 Patch15: Fix-CVE-2020-6096-001.patch
 Patch16: Fix-CVE-2020-6096-002.patch
+Patch17: Fix-CVE-2019-1010023.patch 
 
 Provides: ldconfig rtld(GNU_HASH) bundled(gnulib)
 
@@ -1085,6 +1086,9 @@ fi
 %doc hesiod/README.hesiod
 
 %changelog
+* Thu Sep 10 2020 shanzhikun<shanzhikun@huawei.com> - 2.28-44
+- fix CVE-2019-1010023.
+
 * Mon Jul 20 2020 liqingqing<liqingqing3@huawei.com> - 2.28-43
 - fix CVE-2020-6096
 - fix bugzilla 26137, 26214, 26215
-- 
Gitee