diff --git a/glibc.spec b/glibc.spec index 0420dfe33f0d03b49097ac018315dfe4e36a60e0..41fa7bf3b4d87a985abed971d1f13fa1b37882c9 100644 --- a/glibc.spec +++ b/glibc.spec @@ -70,7 +70,7 @@ ############################################################################## Name: glibc Version: 2.34 -Release: 126 +Release: 127 Summary: The GNU libc libraries License: %{all_license} URL: http://www.gnu.org/software/glibc/ @@ -271,6 +271,7 @@ Patch180: backport-localedata-Adjust-C.UTF-8-to-align-with-C-POSIX.patch Patch181: backport-elf-Make-more-functions-available-for-binding-during.patch Patch182: backport-elf-fix-handling-of-negative-numbers-in-dl-printf.patch Patch183: backport-rtld-properly-handle-root-directory-in-load-path-bug-30435.patch +Patch184: time-Fix-use-after-free-in-getdate.patch Patch9000: turn-default-value-of-x86_rep_stosb_threshold_form_2K_to_1M.patch Patch9001: delete-no-hard-link-to-avoid-all_language-package-to.patch @@ -1486,6 +1487,9 @@ fi %endif %changelog +* Sun Jul 16 2023 Qingqing Li - 2.34-127 +- time: Fix use-after-free in getdate + * Tue Jul 11 2023 lijianglin - 2.34-126 - add the test of the entire GB18030 charmap diff --git a/time-Fix-use-after-free-in-getdate.patch b/time-Fix-use-after-free-in-getdate.patch new file mode 100644 index 0000000000000000000000000000000000000000..c007d80c289c7801539f5ef3cf81932258741f23 --- /dev/null +++ b/time-Fix-use-after-free-in-getdate.patch @@ -0,0 +1,48 @@ +From 85e6d8b4175fcb195011a0a1bad37d6f3b2355db Mon Sep 17 00:00:00 2001 +From: Arjun Shankar +Date: Tue, 6 Jun 2023 19:20:31 +0200 +Subject: [PATCH] time: Fix use-after-free in getdate + +getdate would free the buffer pointed to by the result of its call to +strptime, then reference the same buffer later on -- leading to a +use-after-free. This commit fixes that. + +Reported-by: Martin Coufal +Reviewed-by: Adhemerval Zanella +--- + time/getdate.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/time/getdate.c b/time/getdate.c +index 1dcbd77188..ca058394a3 100644 +--- a/time/getdate.c ++++ b/time/getdate.c +@@ -114,6 +114,7 @@ __getdate_r (const char *string, struct tm *tp) + struct tm tm; + struct __stat64_t64 st; + bool mday_ok = false; ++ bool found = false; + + datemsk = getenv ("DATEMSK"); + if (datemsk == NULL || *datemsk == '\0') +@@ -181,7 +182,7 @@ __getdate_r (const char *string, struct tm *tp) + tp->tm_gmtoff = 0; + tp->tm_zone = NULL; + result = strptime (string, line, tp); +- if (result && *result == '\0') ++ if ((found = (result && *result == '\0'))) + break; + } + while (!__feof_unlocked (fp)); +@@ -201,7 +202,7 @@ __getdate_r (const char *string, struct tm *tp) + /* Close template file. */ + fclose (fp); + +- if (result == NULL || *result != '\0') ++ if (!found) + return 7; + + /* Get current time. */ +-- +2.33.0 +