From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2012) id C1C993858C36; Tue, 30 Jan 2024 18:05:16 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org C1C993858C36 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1706637916; bh=Eq89MC9B9q/+8TODR9a/NbQhTtwAI6KECZ2K8FTaqRA=; h=From:To:Subject:Date:From; b=YVT1KY/RRNgdKwDRVki5Rj+wIRZ/19VZiqPzZ7hFm2jFchPvBApodIb6NENDTQKEA IJkbeau9IxeMlMjmNZCMKrQcqrDkuWjKMdtnQNmW+lDD8SZ7L95F33p3OcxVG/ul2O eGwDIrkqRl4t6C8eXWE0Hzm5lJcS7t4sdQFZjB9A= Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Arjun Shankar To: glibc-cvs@sourceware.org Subject: [glibc/release/2.37/master] syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780) X-Act-Checkin: glibc X-Git-Author: Arjun Shankar X-Git-Refname: refs/heads/release/2.37/master X-Git-Oldrev: 67062eccd9a65d7fda9976a56aeaaf6c25a80214 X-Git-Newrev: 2b58cba076e912961ceaa5fa58588e4b10f791c0 Message-Id: <20240130180516.C1C993858C36@sourceware.org> Date: Tue, 30 Jan 2024 18:05:16 +0000 (GMT) List-Id: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=2b58cba076e912961ceaa5fa58588e4b10f791c0 commit 2b58cba076e912961ceaa5fa58588e4b10f791c0 Author: Arjun Shankar Date: Mon Jan 15 17:44:45 2024 +0100 syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780) __vsyslog_internal calculated a buffer size by adding two integers, but did not first check if the addition would overflow. This commit fixes that. Reviewed-by: Carlos O'Donell Tested-by: Carlos O'Donell (cherry picked from commit ddf542da94caf97ff43cc2875c88749880b7259b) Diff: --- misc/syslog.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/misc/syslog.c b/misc/syslog.c index 3108ae9134..9336036666 100644 --- a/misc/syslog.c +++ b/misc/syslog.c @@ -41,6 +41,7 @@ static char sccsid[] = "@(#)syslog.c 8.4 (Berkeley) 3/18/94"; #include #include #include +#include static int LogType = SOCK_DGRAM; /* type of socket connection */ static int LogFile = -1; /* fd for log */ @@ -217,7 +218,7 @@ __vsyslog_internal (int pri, const char *fmt, va_list ap, vl = __vsnprintf_internal (pos, len, fmt, apc, mode_flags); va_end (apc); - if (vl < 0) + if (vl < 0 || vl >= INT_MAX - l) goto out; if (vl >= len)