glibc: CVE-2020-1752

Backport the CVE patch from upstream:
git://sourceware.org/git/glibc.git
commit ddc650e9b3dc916eab417ce9f79e67337b05035c

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>

diff --git a/meta/recipes-core/glibc/glibc/CVE-2020-1752.patch b/meta/recipes-core/glibc/glibc/CVE-2020-1752.patch
new file mode 100644 (file)
index 0000000..6c347cd
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/CVE-2020-1752.patch
@@ -0,0 +1,66 @@
+From ddc650e9b3dc916eab417ce9f79e67337b05035c Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@suse.de>
+Date: Wed, 19 Feb 2020 17:21:46 +0100
+Subject: [PATCH] Fix use-after-free in glob when expanding ~user (bug 25414)
+
+The value of `end_name' points into the value of `dirname', thus don't
+deallocate the latter before the last use of the former.
+
+CVE: CVE-2020-1752
+Upstream-Status: Backport [git://sourceware.org/git/glibc.git]
+Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
+---
+ posix/glob.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/posix/glob.c b/posix/glob.c
+index cba9cd1819..4580cefb9f 100644
+--- a/posix/glob.c
++++ b/posix/glob.c
+@@ -827,31 +827,32 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
+             {
+               size_t home_len = strlen (p->pw_dir);
+               size_t rest_len = end_name == NULL ? 0 : strlen (end_name);
+-              char *d;
++              char *d, *newp;
++              bool use_alloca = glob_use_alloca (alloca_used,
++                                                 home_len + rest_len + 1);
+ 
+-              if (__glibc_unlikely (malloc_dirname))
+-                free (dirname);
+-              malloc_dirname = 0;
+-
+-              if (glob_use_alloca (alloca_used, home_len + rest_len + 1))
+-                dirname = alloca_account (home_len + rest_len + 1,
+-                                          alloca_used);
++              if (use_alloca)
++                newp = alloca_account (home_len + rest_len + 1, alloca_used);
+               else
+                 {
+-                  dirname = malloc (home_len + rest_len + 1);
+-                  if (dirname == NULL)
++                  newp = malloc (home_len + rest_len + 1);
++                  if (newp == NULL)
+                     {
+                       scratch_buffer_free (&pwtmpbuf);
+                       retval = GLOB_NOSPACE;
+                       goto out;
+                     }
+-                  malloc_dirname = 1;
+                 }
+-              d = mempcpy (dirname, p->pw_dir, home_len);
++              d = mempcpy (newp, p->pw_dir, home_len);
+               if (end_name != NULL)
+                 d = mempcpy (d, end_name, rest_len);
+               *d = '\0';
+ 
++              if (__glibc_unlikely (malloc_dirname))
++                free (dirname);
++              dirname = newp;
++              malloc_dirname = !use_alloca;
++
+               dirlen = home_len + rest_len;
+               dirname_modified = 1;
+             }
+-- 
+2.18.2

diff --git a/meta/recipes-core/glibc/glibc_2.30.bb b/meta/recipes-core/glibc/glibc_2.30.bb
index 84a6538ea147ff430899f4225089aa6c7b1ce576..e9286b6b494e43245a692951ca471b82a7941e03 100644 (file)
--- a/meta/recipes-core/glibc/glibc_2.30.bb
+++ b/meta/recipes-core/glibc/glibc_2.30.bb
@@ -44,6 +44,7 @@ SRC_URI =  "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
            file://CVE-2019-19126.patch \
            file://CVE-2020-10029.patch \
            file://CVE-2020-1751.patch \
+           file://CVE-2020-1752.patch \
            "
 S = "${WORKDIR}/git"
 B = "${WORKDIR}/build-${TARGET_SYS}"