[glibc/release/2.36/master] syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)

[Arjun Shankar <arjun@sourceware.org>]

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b9b7d6a27aa0632f334352fa400771115b3c69b7

commit b9b7d6a27aa0632f334352fa400771115b3c69b7
Author: Arjun Shankar <arjun@redhat.com>
Date:   Mon Jan 15 17:44:45 2024 +0100

    syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)
    
    __vsyslog_internal calculated a buffer size by adding two integers, but
    did not first check if the addition would overflow.  This commit fixes
    that.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    Tested-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit ddf542da94caf97ff43cc2875c88749880b7259b)

Diff:
---
 misc/syslog.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/misc/syslog.c b/misc/syslog.c
index 3108ae9134..9336036666 100644
--- a/misc/syslog.c
+++ b/misc/syslog.c
@@ -41,6 +41,7 @@ static char sccsid[] = "@(#)syslog.c	8.4 (Berkeley) 3/18/94";
 #include <sys/uio.h>
 #include <sys/un.h>
 #include <syslog.h>
+#include <limits.h>
 
 static int LogType = SOCK_DGRAM;	/* type of socket connection */
 static int LogFile = -1;		/* fd for log */
@@ -217,7 +218,7 @@ __vsyslog_internal (int pri, const char *fmt, va_list ap,
     vl = __vsnprintf_internal (pos, len, fmt, apc, mode_flags);
     va_end (apc);
 
-    if (vl < 0)
+    if (vl < 0 || vl >= INT_MAX - l)
       goto out;
 
     if (vl >= len)