rpms/coreutils
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

cp: avoid data-corrupting free-memory-read (upstream fix)

Browse source
This commit is contained in:
Ondřej Vašík 2012-11-05 15:31:41 +01:00
commit 4919491ae4
2 changed files with 34 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

29
coreutils-8.17-cp-freememoryread.patch Normal file
View file

@ -0,0 +1,29 @@
diff -urNp coreutils-8.17-orig/src/extent-scan.c coreutils-8.17/src/extent-scan.c
--- coreutils-8.17-orig/src/extent-scan.c 2012-05-02 10:31:47.000000000 +0200
+++ coreutils-8.17/src/extent-scan.c 2012-11-05 12:05:36.732370966 +0100
@@ -89,7 +89,7 @@ extern bool
extent_scan_read (struct extent_scan *scan)
{
unsigned int si = 0;
- struct extent_info *last_ei IF_LINT ( = scan->ext_info);
+ struct extent_info *last_ei = scan->ext_info;
while (true)
{
@@ -127,8 +127,14 @@ extent_scan_read (struct extent_scan *sc
assert (scan->ei_count <= SIZE_MAX - fiemap->fm_mapped_extents);
scan->ei_count += fiemap->fm_mapped_extents;
- scan->ext_info = xnrealloc (scan->ext_info, scan->ei_count,
- sizeof (struct extent_info));
+ {
+ /* last_ei points into a buffer that may be freed via xnrealloc.
+ Record its offset and adjust after allocation. */
+ size_t prev_idx = last_ei - scan->ext_info;
+ scan->ext_info = xnrealloc (scan->ext_info, scan->ei_count,
+ sizeof (struct extent_info));
+ last_ei = scan->ext_info + prev_idx;
+ }
unsigned int i = 0;
for (i = 0; i < fiemap->fm_mapped_extents; i++)

6
coreutils.spec
View file

@ -18,7 +18,8 @@ Source202: coreutils-su-l.pamd
Source203: coreutils-runuser-l.pamd
# From upstream
patch1: coreutils-8.12-chown.patch
Patch1: coreutils-8.12-chown.patch
Patch2: coreutils-8.17-cp-freememoryread.patch
# Our patches
#general patch to workaround koji build system issues
@ -120,6 +121,7 @@ Libraries for coreutils package.
# From upstream
%patch1 -p1 -b .chown
%patch2 -p1 -b .cpfmr
# Our patches
%patch100 -p1 -b .configure
@ -341,6 +343,8 @@ fi
%changelog
* Mon Nov 05 2012 Ondrej Vasik <ovasik@redhat.com> - 8.12-8
- fix support for ecryptfs mount of "Private" in su (#722323)
- cp: avoid data-corrupting free-memory-read (upstream fix)
* Mon Mar 26 2012 Ondrej Vasik <ovasik@redhat.com> - 8.12-7
- fix sort segfault with multibyte locales (by P.Brady)