← Back to branch summary

~ubuntu-branches/ubuntu/lucid/eglibc/lucid-updates

« back to all changes in this revision

Viewing changes to debian/patches/any/glibc-CVE-2009-5029.patch

  • Committer: Package Import Robot
  • Author(s): Steve Beattie
  • Date: 2012-03-07 10:28:32 UTC
  • mfrom: (42.1.3 lucid-security)
  • Revision ID: package-import@ubuntu.com-20120307102832-om8ercp049cypxlc
Tags: 2.11.1-0ubuntu7.10
https://launchpad.net/bugs/906961
https://launchpad.net/bugs/901716
* SECURITY UPDATE: timezone header parsing integer overflow (LP: #906961)
  - debian/patches/any/glibc-CVE-2009-5029.patch: Check values from
    TZ file header
  - CVE-2009-5029
* SECURITY UPDATE: memory consumption denial of service in fnmatch
  - debian/patches/any/glibc-CVE-2011-1071.patch: avoid too much
    stack use in fnmatch.
  - CVE-2011-1071
* SECURITY UPDATE: /etc/mtab corruption denial of service
  - debian/patches/any/glibc-CVE-2011-1089.patch: Report write
    error in addmnt even for cached streams
  - CVE-2011-1089
* SECURITY UPDATE: insufficient locale environment sanitization
  - debian/patches/any/glibc-CVE-2011-1095.patch: escape contents of
    LANG environment variable.
  - CVE-2011-1095
* SECURITY UPDATE: ld.so insecure handling of privileged programs'
  RPATHs with $ORIGIN
  - debian/patches/any/glibc-CVE-2011-1658.patch: improve handling of
    RPATH and ORIGIN
  - CVE-2011-1658
* SECURITY UPDATE: fnmatch integer overflow
  - debian/patches/any/glibc-CVE-2011-1659.patch: check size of
    pattern in wide character representation
  - CVE-2011-1659
* SECURITY UPDATE: signedness bug in memcpy_ssse3
  - debian/patches/any/glibc-CVE-2011-2702.patch: use unsigned
    comparison instructions
  - CVE-2011-2702
* SECURITY UPDATE: DoS in RPC implementation (LP: #901716)
  - debian/patches/any/glibc-CVE-2011-4609.patch: nanosleep when too
    many open fds is detected
  - CVE-2011-4609
* SECURITY UPDATE: vfprintf nargs overflow leading to FORTIFY
  check bypass
  - debian/patches/any/glibc-CVE-2012-0864.patch: check for integer
    overflow
  - CVE-2012-0864
* debian/testsuite-checking/expected-results-x86_64-linux-gnu-libc,
  debian/testsuite-checking/expected-results-i686-linux-gnu-i386,
  debian/testsuite-checking/expected-results-arm-linux-gnueabi-libc:
  update for pre-existing testsuite failures that prevents FTBFS
  when the testsuite is enabled.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/any/glibc-CVE-2009-5029.patch
 
1
From 97ac2654b2d831acaa18a2b018b0736245903fd2 Mon Sep 17 00:00:00 2001
 
2
From: Ulrich Drepper <drepper@gmail.com>
 
3
Date: Sat, 17 Dec 2011 20:18:42 -0500
 
4
Subject: [PATCH] Check values from TZ file header
 
5
Bug: http://sourceware.org/bugzilla/show_bug.cgi?id=13506
 
6
 
 
7
CVE-2009-5029
 
8
 
 
9
[Ubuntu note: includes typo fix referred to by Allen McRae in
 
10
 http://sourceware.org/bugzilla/show_bug.cgi?id=13506 as well as dropped
 
11
 changes to the NEWS and Changelog file to reduce patch conflicts.]
 
12
 
 
13
---
 
14
 time/tzfile.c |   53 ++++++++++++++++++++++++++++++++++++++++++++---------
 
15
 3 files changed, 50 insertions(+), 10 deletions(-)
 
16
 
 
17
diff --git a/time/tzfile.c b/time/tzfile.c
 
18
index 144e20b..402389c 100644
 
19
--- a/time/tzfile.c
 
20
+++ b/time/tzfile.c
 
21
@@ -26,6 +26,7 @@
 
22
 #include <time.h>
 
23
 #include <unistd.h>
 
24
 #include <sys/stat.h>
 
25
+#include <stdint.h>
 
26
 
 
27
 #define        NOID
 
28
 #include <timezone/tzfile.h>
 
29
@@ -234,23 +234,58 @@ __tzfile_read (const char *file, size_t extra, char **extrap)
 
30
       goto read_again;
 
31
     }
 
32
 
 
33
+  if (__builtin_expect (num_transitions
 
34
+                       > ((SIZE_MAX - (__alignof__ (struct ttinfo) - 1))
 
35
+                          / (sizeof (time_t) + 1)), 0))
 
36
+    goto lose;
 
37
   total_size = num_transitions * (sizeof (time_t) + 1);
 
38
   total_size = ((total_size + __alignof__ (struct ttinfo) - 1)
 
39
                & ~(__alignof__ (struct ttinfo) - 1));
 
40
   types_idx = total_size;
 
41
-  total_size += num_types * sizeof (struct ttinfo) + chars;
 
42
+  if (__builtin_expect (num_types
 
43
+                       > (SIZE_MAX - total_size) / sizeof (struct ttinfo), 0))
 
44
+    goto lose;
 
45
+  total_size += num_types * sizeof (struct ttinfo);
 
46
+  if (__builtin_expect (chars > SIZE_MAX - total_size, 0))
 
47
+    goto lose;
 
48
+  total_size += chars;
 
49
+  if (__builtin_expect (__alignof__ (struct leap) - 1
 
50
+                       > SIZE_MAX - total_size, 0))
 
51
+    goto lose;
 
52
   total_size = ((total_size + __alignof__ (struct leap) - 1)
 
53
                & ~(__alignof__ (struct leap) - 1));
 
54
   leaps_idx = total_size;
 
55
+  if (__builtin_expect (num_leaps
 
56
+                       > (SIZE_MAX - total_size) / sizeof (struct leap), 0))
 
57
+    goto lose;
 
58
   total_size += num_leaps * sizeof (struct leap);
 
59
-  tzspec_len = (sizeof (time_t) == 8 && trans_width == 8
 
60
-               ? st.st_size - (ftello (f)
 
61
-                               + num_transitions * (8 + 1)
 
62
-                               + num_types * 6
 
63
-                               + chars
 
64
-                               + num_leaps * 12
 
65
-                               + num_isstd
 
66
-                               + num_isgmt) - 1 : 0);
 
67
+  tzspec_len = 0;
 
68
+  if (sizeof (time_t) == 8 && trans_width == 8)
 
69
+    {
 
70
+      off_t rem = st.st_size - ftello (f);
 
71
+      if (__builtin_expect (rem < 0
 
72
+                           || (size_t) rem < (num_transitions * (8 + 1)
 
73
+                                              + num_types * 6
 
74
+                                              + chars), 0))
 
75
+       goto lose;
 
76
+      tzspec_len = (size_t) rem - (num_transitions * (8 + 1)
 
77
+                                  + num_types * 6
 
78
+                                  + chars);
 
79
+      if (__builtin_expect (num_leaps > SIZE_MAX / 12
 
80
+                           || tzspec_len < num_leaps * 12, 0))
 
81
+       goto lose;
 
82
+      tzspec_len -= num_leaps * 12;
 
83
+      if (__builtin_expect (tzspec_len < num_isstd, 0))
 
84
+       goto lose;
 
85
+      tzspec_len -= num_isstd;
 
86
+      if (__builtin_expect (tzspec_len == 0 || tzspec_len - 1 < num_isgmt, 0))
 
87
+       goto lose;
 
88
+      tzspec_len -= num_isgmt + 1;
 
89
+      if (__builtin_expect (SIZE_MAX - total_size < tzspec_len, 0))
 
90
+       goto lose;
 
91
+    }
 
92
+  if (__builtin_expect (SIZE_MAX - total_size - tzspec_len < extra, 0))
 
93
+    goto lose;
 
94
 
 
95
   /* Allocate enough memory including the extra block requested by the
 
96
      caller.  */
 
97
-- 
 
98
1.7.3.4
 
99