From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2178) id 8DBBB384B000; Thu, 25 Apr 2024 13:39:15 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 8DBBB384B000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1714052355; bh=KSWoMGwstNOKOWEd4FhQu6n9iD0QrjK4MDW/y1Y29Q0=; h=From:To:Subject:Date:From; b=i9CiL4+9dLufCq3Z86oUB2c+8/yfZJBIb4RQ3g53iECnG/L7hS/7snXBj9EN2C2yE jKa0zhYYHf2nUuddtHGkjfSDDD7oAAaWo49tfNYhqpjtOD9DtrTEoDPCacsz7qCVZn RL1aIvQ6h42TVi1vwWT29UUb4pCQt6MIuOShbE9s= Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Florian Weimer To: glibc-cvs@sourceware.org Subject: [glibc/release/2.39/master] CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bug 31677) X-Act-Checkin: glibc X-Git-Author: Florian Weimer X-Git-Refname: refs/heads/release/2.39/master X-Git-Oldrev: 2f8f157eb0cc7f1d8d9a3fcaa8c55bed53b092a8 X-Git-Newrev: 1263d583d2e28afb8be53f8d6922f0842036f35d Message-Id: <20240425133915.8DBBB384B000@sourceware.org> Date: Thu, 25 Apr 2024 13:39:15 +0000 (GMT) List-Id: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1263d583d2e28afb8be53f8d6922f0842036f35d commit 1263d583d2e28afb8be53f8d6922f0842036f35d Author: Florian Weimer Date: Thu Apr 25 15:00:45 2024 +0200 CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bug 31677) Using alloca matches what other caches do. The request length is bounded by MAXKEYLEN. Reviewed-by: Carlos O'Donell (cherry picked from commit 87801a8fd06db1d654eea3e4f7626ff476a9bdaa) Diff: --- nscd/netgroupcache.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c index 0c6e46f15c..f227dc7fa2 100644 --- a/nscd/netgroupcache.c +++ b/nscd/netgroupcache.c @@ -502,12 +502,13 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req, = (struct indataset *) mempool_alloc (db, sizeof (*dataset) + req->key_len, 1); - struct indataset dataset_mem; bool cacheable = true; if (__glibc_unlikely (dataset == NULL)) { cacheable = false; - dataset = &dataset_mem; + /* The alloca is safe because nscd_run_worker verfies that + key_len is not larger than MAXKEYLEN. */ + dataset = alloca (sizeof (*dataset) + req->key_len); } datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len,