lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-08-07 06:43:00 +03:00
Code Activity

Fix underallocation of abort_msg_s struct (CVE-2025-0395)

Browse Source 
Include the space needed to store the length of the message itself, in
addition to the message string.  This resolves BZ #32582.

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
This commit is contained in:
Siddhesh Poyarekar
2025-01-21 16:11:06 -05:00
parent d4626340b9
commit 68ee0f704c
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
assert/assert.c
View File

@@ -17,6 +17,7 @@
#include <intprops.h> #include <intprops.h>
#include <ldsodefs.h> #include <ldsodefs.h>
#include <libc-pointer-arith.h>
#include <libintl.h> #include <libintl.h>
#include <libio/iolibio.h> #include <libio/iolibio.h>
#include <setvmaname.h> #include <setvmaname.h>
@@ -60,7 +61,8 @@ __assert_fail_base (const char *fmt, const char *assertion, const char *file,
(void) __fxprintf (NULL, "%s", str); (void) __fxprintf (NULL, "%s", str);
(void) fflush (stderr); (void) fflush (stderr);
total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1); total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1,
GLRO(dl_pagesize));
struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE, struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE,
MAP_ANON | MAP_PRIVATE, -1, 0); MAP_ANON | MAP_PRIVATE, -1, 0);
if (__glibc_likely (buf != MAP_FAILED)) if (__glibc_likely (buf != MAP_FAILED))

4
sysdeps/posix/libc_fatal.c
View File

@@ -20,6 +20,7 @@
#include <errno.h> #include <errno.h>
#include <fcntl.h> #include <fcntl.h>
#include <ldsodefs.h> #include <ldsodefs.h>
#include <libc-pointer-arith.h>
#include <paths.h> #include <paths.h>
#include <stdarg.h> #include <stdarg.h>
#include <stdbool.h> #include <stdbool.h>
@@ -105,7 +106,8 @@ __libc_message_impl (const char *fmt, ...)
{ {
WRITEV_FOR_FATAL (fd, iov, iovcnt, total); WRITEV_FOR_FATAL (fd, iov, iovcnt, total);
total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1); total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1,
GLRO(dl_pagesize));
struct abort_msg_s *buf = __mmap (NULL, total, struct abort_msg_s *buf = __mmap (NULL, total,
PROT_READ | PROT_WRITE, PROT_READ | PROT_WRITE,
MAP_ANON | MAP_PRIVATE, -1, 0); MAP_ANON | MAP_PRIVATE, -1, 0);