Re: [COMMITTED 2.25 3/8] CVE-2017-15670: glob: Fix one-byte overflow [BZ #22320]

[Aurelien Jarno <aurelien@aurel32.net>]

On 2017-12-15 03:41, Dmitry V. Levin wrote:
> On Sat, Dec 02, 2017 at 10:52:01AM +0100, Aurelien Jarno wrote:
> > From: Paul Eggert <eggert@cs.ucla.edu>
> > 
> > (cherry picked from commit c369d66e5426a30e4725b100d5cd28e372754f90)
> > ---
> >  ChangeLog    | 6 ++++++
> >  NEWS         | 7 +++++++
> >  posix/glob.c | 2 +-
> >  3 files changed, 14 insertions(+), 1 deletion(-)
> > 
> > diff --git a/ChangeLog b/ChangeLog
> > index f9ea53f23e..44eb9d7d7c 100644
> > --- a/ChangeLog
> > +++ b/ChangeLog
> > @@ -1,3 +1,9 @@
> > +2017-10-20  Paul Eggert <eggert@cs.ucla.edu>
> > +
> > +	[BZ #22320]
> > +	CVE-2017-15670
> > +	* posix/glob.c (__glob): Fix one-byte overflow.
> > +
> >  2017-09-08  Adhemerval Zanella  <adhemerval.zanella@linaro.org>
> >  
> >  	[BZ #1062]
> > diff --git a/NEWS b/NEWS
> > index 1879b735e6..98aa362444 100644
> > --- a/NEWS
> > +++ b/NEWS
> > @@ -29,6 +29,13 @@ The following bugs are resolved with this release:
> >    [21778] Robust mutex may deadlock
> >    [21972] assert macro requires operator== (int) for its argument type
> >    [22322] libc: [mips64] wrong bits/long-double.h installed
> > +
> > +Security related changes:
> > +
> > +  CVE-2017-15670: The glob function, when invoked with GLOB_TILDE, suffered
> > +  from a one-byte overflow during ~ operator processing (either on the stack
> > +  or the heap, depending on the length of the user name).
> > +
> >  \f
> >  Version 2.25
> >  
> 
> I'd like to apply the following fix on top of it:
> 
> Subject: [PATCH] NEWS: merge two sections about security related changes in 2.25.1
> 
> Commit glibc-2.25-70-g717743bb07471f95bef6ea63d9b12848ad91aaf6
> introduced a second "Security related changes" section for 2.25.1.
> Merge them back into a single section.
> ---
>  NEWS | 11 ++++-------
>  1 file changed, 4 insertions(+), 7 deletions(-)
> 
> diff --git a/NEWS b/NEWS
> index 0a8f20e..d047d96 100644
> --- a/NEWS
> +++ b/NEWS
> @@ -12,6 +12,10 @@ Security related changes:
>  * The DNS stub resolver limits the advertised UDP buffer size to 1200 bytes,
>    to avoid fragmentation-based spoofing attacks.
>  
> +  CVE-2017-15670: The glob function, when invoked with GLOB_TILDE, suffered
> +  from a one-byte overflow during ~ operator processing (either on the stack
> +  or the heap, depending on the length of the user name).
> +
>    CVE-2017-15671: The glob function, when invoked with GLOB_TILDE,
>    would sometimes fail to free memory allocated during ~ operator
>    processing, leading to a memory leak and, potentially, to a denial
> @@ -38,13 +42,6 @@ The following bugs are resolved with this release:
>    [21778] Robust mutex may deadlock
>    [21972] assert macro requires operator== (int) for its argument type
>    [22322] libc: [mips64] wrong bits/long-double.h installed
> -
> -Security related changes:
> -
> -  CVE-2017-15670: The glob function, when invoked with GLOB_TILDE, suffered
> -  from a one-byte overflow during ~ operator processing (either on the stack
> -  or the heap, depending on the length of the user name).
> -
>  \f
>  Version 2.25

Oops, I clearly failed to merge NEWS correctly, sorry about the mess.
The patch looks all good to me, thanks for noticing and fixing that.

-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                 http://www.aurel32.net