[COMMITTED 2.25 3/8] CVE-2017-15670: glob: Fix one-byte overflow [BZ #22320]

[Dmitry V. Levin]

On Sat, Dec 02, 2017 at 10:52:01AM +0100, Aurelien Jarno wrote:
> From: Paul Eggert <eggert@cs.ucla.edu>
> 
> (cherry picked from commit c369d66e5426a30e4725b100d5cd28e372754f90)
> ---
>  ChangeLog    | 6 ++++++
>  NEWS         | 7 +++++++
>  posix/glob.c | 2 +-
>  3 files changed, 14 insertions(+), 1 deletion(-)
> 
> diff --git a/ChangeLog b/ChangeLog
> index f9ea53f23e..44eb9d7d7c 100644
> --- a/ChangeLog
> +++ b/ChangeLog
> @@ -1,3 +1,9 @@
> +2017-10-20  Paul Eggert <eggert@cs.ucla.edu>
> +
> +	[BZ #22320]
> +	CVE-2017-15670
> +	* posix/glob.c (__glob): Fix one-byte overflow.
> +
>  2017-09-08  Adhemerval Zanella  <adhemerval.zanella@linaro.org>
>  
>  	[BZ #1062]
> diff --git a/NEWS b/NEWS
> index 1879b735e6..98aa362444 100644
> --- a/NEWS
> +++ b/NEWS
> @@ -29,6 +29,13 @@ The following bugs are resolved with this release:
>    [21778] Robust mutex may deadlock
>    [21972] assert macro requires operator== (int) for its argument type
>    [22322] libc: [mips64] wrong bits/long-double.h installed
> +
> +Security related changes:
> +
> +  CVE-2017-15670: The glob function, when invoked with GLOB_TILDE, suffered
> +  from a one-byte overflow during ~ operator processing (either on the stack
> +  or the heap, depending on the length of the user name).
> +
>  
>  Version 2.25
>  

I'd like to apply the following fix on top of it:

Subject: [PATCH] NEWS: merge two sections about security related changes in 2.25.1

Commit glibc-2.25-70-g717743bb07471f95bef6ea63d9b12848ad91aaf6
introduced a second "Security related changes" section for 2.25.1.
Merge them back into a single section.
---
 NEWS | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/NEWS b/NEWS
index 0a8f20e..d047d96 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,10 @@ Security related changes:
 * The DNS stub resolver limits the advertised UDP buffer size to 1200 bytes,
   to avoid fragmentation-based spoofing attacks.
 
+  CVE-2017-15670: The glob function, when invoked with GLOB_TILDE, suffered
+  from a one-byte overflow during ~ operator processing (either on the stack
+  or the heap, depending on the length of the user name).
+
   CVE-2017-15671: The glob function, when invoked with GLOB_TILDE,
   would sometimes fail to free memory allocated during ~ operator
   processing, leading to a memory leak and, potentially, to a denial
@@ -38,13 +42,6 @@ The following bugs are resolved with this release:
   [21778] Robust mutex may deadlock
   [21972] assert macro requires operator== (int) for its argument type
   [22322] libc: [mips64] wrong bits/long-double.h installed
-
-Security related changes:
-
-  CVE-2017-15670: The glob function, when invoked with GLOB_TILDE, suffered
-  from a one-byte overflow during ~ operator processing (either on the stack
-  or the heap, depending on the length of the user name).
-
 
 Version 2.25
 
-- 
ldv