[Bug libc/17048] posix_spawn_file_actions_addopen fails to copy the path argument (CVE-2014-4043)

["cvs-commit at gcc dot gnu.org" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=17048

--- Comment #4 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, gentoo/2.19 has been updated
       via  4545280f9c1ab06efa9348ab46bac436f5885244 (commit)
       via  e1449bcd91f738ea4b0b6d75bb3e1f21827cf047 (commit)
       via  49ca74fb26ce91b00de6df7bcae7ee2923f5f047 (commit)
      from  b76e856d84e14d5ece6988fee589aff26d6ac2f2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4545280f9c1ab06efa9348ab46bac436f5885244

commit 4545280f9c1ab06efa9348ab46bac436f5885244
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
Date:   Thu Feb 27 21:29:16 2014 +0530

    Fix sign of input to bsloww1 (BZ #16623)

    In 84ba214c, I removed some redundant sign computations and in the
    process, I incorrectly got rid of a temporary variable, thus passing
    the absolute value of the input to bsloww1.  This caused #16623.

    This fix undoes the incorrect change.

    (cherry picked from commit ffe768a90912f9bce43b70a82576b3dc99e3121c)

    https://bugs.gentoo.org/509494
    https://sourceware.org/bugzilla/show_bug.cgi?id=16623

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e1449bcd91f738ea4b0b6d75bb3e1f21827cf047

commit e1449bcd91f738ea4b0b6d75bb3e1f21827cf047
Author: Stefan Liebler <stli@linux.vnet.ibm.com>
Date:   Thu Jun 12 14:15:25 2014 +0200

    posix_spawn_faction_addopen: Add missing string.h include directive

    This is needed to avoid a PLT call on s390.

    (cherry picked from commit 35a5e3e338ae17f3d42c60a708763c5d498fb840)

    https://bugs.gentoo.org/513090
    https://sourceware.org/bugzilla/show_bug.cgi?id=17048

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=49ca74fb26ce91b00de6df7bcae7ee2923f5f047

commit 49ca74fb26ce91b00de6df7bcae7ee2923f5f047
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Jun 11 23:12:52 2014 +0200

    posix_spawn_file_actions_addopen needs to copy the path argument (BZ 17048)

    POSIX requires that we make a copy, so we allocate a new string
    and free it in posix_spawn_file_actions_destroy.

    Reported by David Reid, Alex Gaynor, and Glyph Lefkowitz.  This bug
    may have security implications.

    (cherry picked from commit 89e435f3559c53084498e9baad22172b64429362)

    https://bugs.gentoo.org/513090
    https://sourceware.org/bugzilla/show_bug.cgi?id=17048

-----------------------------------------------------------------------

Summary of changes:
 posix/spawn_faction_addopen.c  |   14 +++++++++++---
 posix/spawn_faction_destroy.c  |   22 ++++++++++++++++++++--
 posix/spawn_int.h              |    2 +-
 posix/tst-spawn.c              |   10 +++++++++-
 sysdeps/ieee754/dbl-64/s_sin.c |   16 ++++++++++------
 5 files changed, 51 insertions(+), 13 deletions(-)

-- 
You are receiving this mail because:
You are on the CC list for the bug.