This is the mail archive of the
glibc-bugs@sourceware.org
mailing list for the glibc project.
[Bug glob/22332] Buffer overflow in glob with GLOB_TILDE in unescaping (CVE-2017-15804)
- From: "cvs-commit at gcc dot gnu.org" <sourceware-bugzilla at sourceware dot org>
- To: glibc-bugs at sourceware dot org
- Date: Sun, 03 Dec 2017 21:45:08 +0000
- Subject: [Bug glob/22332] Buffer overflow in glob with GLOB_TILDE in unescaping (CVE-2017-15804)
- Auto-submitted: auto-generated
- References: <bug-22332-131@http.sourceware.org/bugzilla/>
https://sourceware.org/bugzilla/show_bug.cgi?id=22332
--- Comment #9 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".
The branch, release/2.24/master has been updated
via d81254d2efcb839fd11df2960df5bba579193808 (commit)
via bddc5728810859952a2acaec6302308361e828cc (commit)
via 94825c8924b80518214ad9e3ca1f6589f209592c (commit)
via 1e53b88296dc95d325d6073910a33dca851b6bc4 (commit)
via 5ff2eb52b236ca3d77f92272e8711b3c2b98140b (commit)
via 1f523e3c6efd673bdd05cbec85ff6ba178ba6e08 (commit)
via 832e2ec56701f85b892b782b8b749bc5a33899fb (commit)
via 89bf8ef2dba93e19385bf922fdcee87a97db768f (commit)
from bea3f92405f705684275bffee954cafe84ffb09d (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d81254d2efcb839fd11df2960df5bba579193808
commit d81254d2efcb839fd11df2960df5bba579193808
Author: Aurelien Jarno <aurelien@aurel32.net>
Date: Fri Dec 1 21:53:51 2017 +0100
Update NEWS to add CVE-2017-15804 entry
(cherry picked from commit 15e84c63c05e0652047ba5e738c54d79d62ba74b)
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=bddc5728810859952a2acaec6302308361e828cc
commit bddc5728810859952a2acaec6302308361e828cc
Author: Florian Weimer <fweimer@redhat.com>
Date: Thu Nov 2 11:06:45 2017 +0100
posix/tst-glob-tilde.c: Add test for bug 22332
(cherry picked from commit 2fac6a6cd50c22ac28c97d0864306594807ade3e)
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=94825c8924b80518214ad9e3ca1f6589f209592c
commit 94825c8924b80518214ad9e3ca1f6589f209592c
Author: Paul Eggert <eggert@cs.ucla.edu>
Date: Sun Oct 22 10:00:57 2017 +0200
glob: Fix buffer overflow during GLOB_TILDE unescaping [BZ #22332]
(cherry picked from commit a159b53fa059947cc2548e3b0d5bdcf7b9630ba8)
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1e53b88296dc95d325d6073910a33dca851b6bc4
commit 1e53b88296dc95d325d6073910a33dca851b6bc4
Author: Florian Weimer <fweimer@redhat.com>
Date: Sun Oct 22 09:29:52 2017 +0200
Update NEWS and ChangeLog for CVE-2017-15671
(cherry picked from commit 914c9994d27b80bc3b71c483e801a4f04e269ba6)
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5ff2eb52b236ca3d77f92272e8711b3c2b98140b
commit 5ff2eb52b236ca3d77f92272e8711b3c2b98140b
Author: Florian Weimer <fweimer@redhat.com>
Date: Sat Oct 21 18:03:30 2017 +0200
glob: Add new test tst-glob-tilde
The new test checks for memory leaks (see bug 22325) and attempts
to trigger the buffer overflow in bug 22320.
(cherry picked from commit e80fc1fc98bf614eb01cf8325503df3a1451a99c)
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1f523e3c6efd673bdd05cbec85ff6ba178ba6e08
commit 1f523e3c6efd673bdd05cbec85ff6ba178ba6e08
Author: Paul Eggert <eggert@cs.ucla.edu>
Date: Fri Oct 20 18:41:14 2017 +0200
CVE-2017-15670: glob: Fix one-byte overflow [BZ #22320]
(cherry picked from commit c369d66e5426a30e4725b100d5cd28e372754f90)
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=832e2ec56701f85b892b782b8b749bc5a33899fb
commit 832e2ec56701f85b892b782b8b749bc5a33899fb
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date: Mon Sep 4 14:53:38 2017 -0300
posix: Sync glob with gnulib [BZ #1062]
This patch syncs posix/glob.c implementation with gnulib version
b5ec983 (glob: simplify symlink detection). The only difference
to gnulib code is
* DT_UNKNOWN, DT_DIR, and DT_LNK definition in the case there
were not already defined. Gnulib code which uses
HAVE_STRUCT_DIRENT_D_TYPE will redefine them wrongly because
GLIBC does not define HAVE_STRUCT_DIRENT_D_TYPE. Instead
the patch check for each definition instead.
Also, the patch requires additional globfree and globfree64 files
for compatibility version on some architectures. Also the code
simplification leads to not macro simplification (not need for
NO_GLOB_PATTERN_P anymore).
Checked on x86_64-linux-gnu and on a build using build-many-glibcs.py
for all major architectures.
[BZ #1062]
* posix/Makefile (routines): Add globfree, globfree64, and
glob_pattern_p.
* posix/flexmember.h: New file.
* posix/glob_internal.h: Likewise.
* posix/glob_pattern_p.c: Likewise.
* posix/globfree.c: Likewise.
* posix/globfree64.c: Likewise.
* sysdeps/gnu/globfree64.c: Likewise.
* sysdeps/unix/sysv/linux/alpha/globfree.c: Likewise.
* sysdeps/unix/sysv/linux/mips/mips64/n64/globfree64.c: Likewise.
* sysdeps/unix/sysv/linux/oldglob.c: Likewise.
* sysdeps/unix/sysv/linux/wordsize-64/globfree64.c: Likewise.
* sysdeps/unix/sysv/linux/x86_64/x32/globfree.c: Likewise.
* sysdeps/wordsize-64/globfree.c: Likewise.
* sysdeps/wordsize-64/globfree64.c: Likewise.
* posix/glob.c (HAVE_CONFIG_H): Use !_LIBC instead.
[NDEBUG): Remove comments.
(GLOB_ONLY_P, _AMIGA, VMS): Remove define.
(dirent_type): New type. Use uint_fast8_t not
uint8_t, as C99 does not require uint8_t.
(DT_UNKNOWN, DT_DIR, DT_LNK): New macros.
(struct readdir_result): Use dirent_type. Do not define skip_entry
unless it is needed; this saves a byte on platforms lacking d_ino.
(readdir_result_type, readdir_result_skip_entry):
New functions, replacing ...
(readdir_result_might_be_symlink, readdir_result_might_be_dir):
these functions, which were removed. This makes the callers
easier to read. All callers changed.
(D_INO_TO_RESULT): Now empty if there is no d_ino.
(size_add_wrapv, glob_use_alloca): New static functions.
(glob, glob_in_dir): Check for size_t overflow in several places,
and fix some size_t checks that were not quite right.
Remove old code using SHELL since Bash no longer
uses this.
(glob, prefix_array): Separate MS code better.
(glob_in_dir): Remove old Amiga and VMS code.
(globfree, __glob_pattern_type, __glob_pattern_p): Move to
separate files.
(glob_in_dir): Do not rely on undefined behavior in accessing
struct members beyond their bounds. Use a flexible array member
instead
(link_stat): Rename from link_exists2_p and return -1/0 instead of
0/1. Caller changed.
(glob): Fix memory leaks.
* posix/glob64 (globfree64): Move to separate file.
* sysdeps/gnu/glob64.c (NO_GLOB_PATTERN_P): Remove define.
(globfree64): Remove hidden alias.
* sysdeps/unix/sysv/linux/Makefile (sysdeps_routines): Add
oldglob.
* sysdeps/unix/sysv/linux/alpha/glob.c (__new_globfree): Move to
separate file.
* sysdeps/unix/sysv/linux/i386/glob64.c (NO_GLOB_PATTERN_P): Remove
define.
Move compat code to separate file.
* sysdeps/wordsize-64/glob.c (globfree): Move definitions to
separate file.
(cherry picked from commit c66c908230169c1bab1f83b071eb585baa214b9f)
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=89bf8ef2dba93e19385bf922fdcee87a97db768f
commit 89bf8ef2dba93e19385bf922fdcee87a97db768f
Author: H.J. Lu <hjl.tools@gmail.com>
Date: Sun Aug 20 10:46:47 2017 -0700
i386: Hide __old_glob64 [BZ #18822]
Hide internal __old_glob64 function to allow direct access within
libc.so and libc.a without using GOT nor PLT.
[BZ #18822]
* sysdeps/unix/sysv/linux/i386/glob64.c (__old_glob64): Add
libc_hidden_proto and libc_hidden_def.
(cherry picked from commit 2585d7b839559e665d5723734862fbe62264b25d)
(cherry picked from commit 2b54f16a8a237a1f3e6f8b974cafda09ed75d292)
-----------------------------------------------------------------------
Summary of changes:
ChangeLog | 94 +++
NEWS | 13 +
posix/Makefile | 13 +-
posix/flexmember.h | 45 ++
posix/glob.c | 780 ++++++++++----------
posix/glob64.c | 6 -
posix/glob_internal.h | 57 ++
posix/glob_pattern_p.c | 33 +
posix/globfree.c | 41 +
posix/globfree64.c | 31 +
posix/tst-glob-tilde.c | 143 ++++
sysdeps/gnu/glob64.c | 3 -
sysdeps/gnu/globfree64.c | 10 +
sysdeps/unix/sysv/linux/Makefile | 2 +-
sysdeps/unix/sysv/linux/alpha/glob.c | 4 -
sysdeps/unix/sysv/linux/alpha/globfree.c | 37 +
sysdeps/unix/sysv/linux/i386/glob64.c | 36 +-
.../unix/sysv/linux/mips/mips64/n64/globfree64.c | 1 +
sysdeps/unix/sysv/linux/oldglob.c | 42 ++
sysdeps/unix/sysv/linux/wordsize-64/globfree64.c | 2 +
sysdeps/unix/sysv/linux/x86_64/x32/globfree.c | 1 +
sysdeps/wordsize-64/glob.c | 2 -
sysdeps/wordsize-64/globfree.c | 5 +
sysdeps/wordsize-64/globfree64.c | 1 +
24 files changed, 941 insertions(+), 461 deletions(-)
create mode 100644 posix/flexmember.h
create mode 100644 posix/glob_internal.h
create mode 100644 posix/glob_pattern_p.c
create mode 100644 posix/globfree.c
create mode 100644 posix/globfree64.c
create mode 100644 posix/tst-glob-tilde.c
create mode 100644 sysdeps/gnu/globfree64.c
create mode 100644 sysdeps/unix/sysv/linux/alpha/globfree.c
create mode 100644 sysdeps/unix/sysv/linux/mips/mips64/n64/globfree64.c
create mode 100644 sysdeps/unix/sysv/linux/oldglob.c
create mode 100644 sysdeps/unix/sysv/linux/wordsize-64/globfree64.c
create mode 100644 sysdeps/unix/sysv/linux/x86_64/x32/globfree.c
create mode 100644 sysdeps/wordsize-64/globfree.c
create mode 100644 sysdeps/wordsize-64/globfree64.c
--
You are receiving this mail because:
You are on the CC list for the bug.