From 4919491ae406ffa7eae2cdd0a1aef97874a8090f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Va=C5=A1=C3=ADk?= Date: Mon, 5 Nov 2012 15:31:41 +0100 Subject: [PATCH] cp: avoid data-corrupting free-memory-read (upstream fix) --- coreutils-8.17-cp-freememoryread.patch | 29 ++++++++++++++++++++++++++ coreutils.spec | 6 +++++- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 coreutils-8.17-cp-freememoryread.patch diff --git a/coreutils-8.17-cp-freememoryread.patch b/coreutils-8.17-cp-freememoryread.patch new file mode 100644 index 0000000..be4a429 --- /dev/null +++ b/coreutils-8.17-cp-freememoryread.patch @@ -0,0 +1,29 @@ +diff -urNp coreutils-8.17-orig/src/extent-scan.c coreutils-8.17/src/extent-scan.c +--- coreutils-8.17-orig/src/extent-scan.c 2012-05-02 10:31:47.000000000 +0200 ++++ coreutils-8.17/src/extent-scan.c 2012-11-05 12:05:36.732370966 +0100 +@@ -89,7 +89,7 @@ extern bool + extent_scan_read (struct extent_scan *scan) + { + unsigned int si = 0; +- struct extent_info *last_ei IF_LINT ( = scan->ext_info); ++ struct extent_info *last_ei = scan->ext_info; + + while (true) + { +@@ -127,8 +127,14 @@ extent_scan_read (struct extent_scan *sc + + assert (scan->ei_count <= SIZE_MAX - fiemap->fm_mapped_extents); + scan->ei_count += fiemap->fm_mapped_extents; +- scan->ext_info = xnrealloc (scan->ext_info, scan->ei_count, +- sizeof (struct extent_info)); ++ { ++ /* last_ei points into a buffer that may be freed via xnrealloc. ++ Record its offset and adjust after allocation. */ ++ size_t prev_idx = last_ei - scan->ext_info; ++ scan->ext_info = xnrealloc (scan->ext_info, scan->ei_count, ++ sizeof (struct extent_info)); ++ last_ei = scan->ext_info + prev_idx; ++ } + + unsigned int i = 0; + for (i = 0; i < fiemap->fm_mapped_extents; i++) diff --git a/coreutils.spec b/coreutils.spec index 5c23927..0cd56b9 100644 --- a/coreutils.spec +++ b/coreutils.spec @@ -18,7 +18,8 @@ Source202: coreutils-su-l.pamd Source203: coreutils-runuser-l.pamd # From upstream -patch1: coreutils-8.12-chown.patch +Patch1: coreutils-8.12-chown.patch +Patch2: coreutils-8.17-cp-freememoryread.patch # Our patches #general patch to workaround koji build system issues @@ -120,6 +121,7 @@ Libraries for coreutils package. # From upstream %patch1 -p1 -b .chown +%patch2 -p1 -b .cpfmr # Our patches %patch100 -p1 -b .configure @@ -341,6 +343,8 @@ fi %changelog * Mon Nov 05 2012 Ondrej Vasik - 8.12-8 +- fix support for ecryptfs mount of "Private" in su (#722323) +- cp: avoid data-corrupting free-memory-read (upstream fix) * Mon Mar 26 2012 Ondrej Vasik - 8.12-7 - fix sort segfault with multibyte locales (by P.Brady)