diff --git a/backport-Add-missing-overflow-check-for-num_values-in-pytdb.c.patch b/backport-Add-missing-overflow-check-for-num_values-in-pytdb.c.patch new file mode 100644 index 0000000000000000000000000000000000000000..9b58153587224cb4abdfdad9b0b10f26b18ee5fb --- /dev/null +++ b/backport-Add-missing-overflow-check-for-num_values-in-pytdb.c.patch @@ -0,0 +1,51 @@ +From 82b07bd048e8039896be7edec6b83cbd6ff218d9 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 30 Apr 2024 14:16:33 +0200 +Subject: [PATCH] lib:tdb: Add missing overflow check for num_values in pytdb.c + +Reference:https://github.com/samba-team/samba/commit/82b07bd048e8039896be7edec6b83cbd6ff218d9 +Conflict:NA + +Error: INTEGER_OVERFLOW (CWE-190): +tdb-1.4.10/pytdb.c:401: cast_overflow: Truncation due to cast operation on "num_values" from 64 to 32 bits. +tdb-1.4.10/pytdb.c:401: overflow_sink: "num_values", which might have overflowed, is passed to "tdb_storev(self->ctx, key, values, num_values, flag)". + 399| } + 400| + 401|-> ret = tdb_storev(self->ctx, key, values, num_values, flag); + 402| free(values); + 403| PyErr_TDB_ERROR_IS_ERR_RAISE(ret, self->ctx); + +Signed-off-by: Andreas Schneider +Reviewed-by: Volker Lendecke +--- + pytdb.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/pytdb.c b/pytdb.c +index d47d933..4d0b9d4 100644 +--- a/pytdb.c ++++ b/pytdb.c +@@ -407,6 +407,10 @@ static PyObject *obj_storev(PyTdbObject *self, PyObject *args) + PyErr_SetFromErrno(PyExc_OverflowError); + return NULL; + } ++ if (num_values > INT_MAX) { ++ PyErr_SetFromErrno(PyExc_OverflowError); ++ return NULL; ++ } + values = malloc(sizeof(TDB_DATA) * num_values); + if (values == NULL) { + PyErr_NoMemory(); +@@ -422,7 +426,7 @@ static PyObject *obj_storev(PyTdbObject *self, PyObject *args) + values[i] = value; + } + +- ret = tdb_storev(self->ctx, key, values, num_values, flag); ++ ret = tdb_storev(self->ctx, key, values, (int)num_values, flag); + free(values); + PyErr_TDB_ERROR_IS_ERR_RAISE(ret, self->ctx); + Py_RETURN_NONE; +-- +2.33.0 + + diff --git a/libtdb.spec b/libtdb.spec index a311932fce5cd0e14a08df0f4d361f6b17373772..defd165ec288ececdebe4987738790d8c6e71eab 100644 --- a/libtdb.spec +++ b/libtdb.spec @@ -1,12 +1,13 @@ Name: libtdb Version: 1.4.9 -Release: 2 +Release: 3 Summary: The Tdb library License: LGPLv3+ URL: http://tdb.samba.org/ Source: http://samba.org/ftp/tdb/tdb-%{version}.tar.gz Patch6000: backport-tdb-Do-not-pass-non-null-terminated-strings-to-strcm.patch +Patch6001: backport-Add-missing-overflow-check-for-num_values-in-pytdb.c.patch BuildRequires: gcc libxslt docbook-style-xsl BuildRequires: python3-devel @@ -89,6 +90,12 @@ make %{?_smp_mflags} check %ldconfig_scriptlets %changelog +* Tue Jun 11 2024 shixuantong - 1.4.9-3 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:Add missing overflow check for num_values in pytdb.c + * Wed May 08 2024 wangjiang - 1.4.9-2 - Type:bugfix - CVE:NA