Hello community,
here is the log from the commit of package glibc for openSUSE:11.3
checked in at Mon Dec 19 16:28:34 CET 2011.
--------
--- old-versions/11.3/UPDATES/all/glibc/glibc.changes 2011-07-27 10:18:03.000000000 +0200
+++ 11.3/glibc/glibc.changes 2011-12-19 11:55:07.000000000 +0100
@@ -1,0 +2,6 @@
+Mon Dec 19 10:52:50 UTC 2011 - aj@suse.de
+
+- Fix timezone loader overflow (bnc#735850,CVE-2009-5029) (patch
+ tzfile-corruption-fix.patch)
+
+-------------------------------------------------------------------
calling whatdependson for 11.3-i586
Old:
----
minmem
New:
----
tzfile-corruption-fix.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ glibc.spec ++++++
--- /var/tmp/diff_new_pack.8gmdAd/_old 2011-12-19 16:09:52.000000000 +0100
+++ /var/tmp/diff_new_pack.8gmdAd/_new 2011-12-19 16:09:52.000000000 +0100
@@ -65,7 +65,7 @@
Provides: rtld(GNU_HASH)
AutoReqProv: on
Version: 2.11.2
-Release: 3.<RELEASE5>
+Release: 3.<RELEASE7>
Url: http://www.gnu.org/software/libc/libc.html
PreReq: filesystem
BuildRoot: %{_tmppath}/%{name}-%{version}-build
@@ -144,6 +144,7 @@
Patch67: glibc-nis-initgroups.diff
Patch68: glibc-nscd-hconf.diff
Patch69: glibc-2.11.3-audit.diff
+Patch70: tzfile-corruption-fix.patch
Patch500: ARM_glibc-2.10.1-local-eabi-wchar.diff
Patch501: ARM_glibc-2.10.1-local-hwcap-updates.diff
Patch502: ARM_glibc-2.10.1-local-lowlevellock.diff
@@ -371,6 +372,7 @@
%patch67 -p1
%patch68 -p1
%patch69 -p1
+%patch70 -p1
%ifarch %arm armv5tel armv7l
%patch500
%patch501
++++++ tzfile-corruption-fix.patch ++++++
2011-12-17 Ulrich Drepper
[BZ #13506]
* time/tzfile.c (__tzfile_read): Check values from file header.
diff --git a/time/tzfile.c b/time/tzfile.c
index 144e20b..402389c 100644
--- a/time/tzfile.c
+++ b/time/tzfile.c
@@ -234,23 +234,58 @@ __tzfile_read (const char *file, size_t extra, char **extrap)
goto read_again;
}
+ if (__builtin_expect (num_transitions
+ > ((SIZE_MAX - (__alignof__ (struct ttinfo) - 1))
+ / (sizeof (time_t) + 1)), 0))
+ goto lose;
total_size = num_transitions * (sizeof (time_t) + 1);
total_size = ((total_size + __alignof__ (struct ttinfo) - 1)
& ~(__alignof__ (struct ttinfo) - 1));
types_idx = total_size;
- total_size += num_types * sizeof (struct ttinfo) + chars;
+ if (__builtin_expect (num_types
+ > (SIZE_MAX - total_size) / sizeof (struct ttinfo), 0))
+ goto lose;
+ total_size += num_types * sizeof (struct ttinfo);
+ if (__builtin_expect (chars > SIZE_MAX - total_size, 0))
+ goto lose;
+ total_size += chars;
+ if (__builtin_expect (__alignof__ (struct leap) - 1
+ > SIZE_MAX - total_size, 0))
+ goto lose;
total_size = ((total_size + __alignof__ (struct leap) - 1)
& ~(__alignof__ (struct leap) - 1));
leaps_idx = total_size;
+ if (__builtin_expect (num_leaps
+ > (SIZE_MAX - total_size) / sizeof (struct leap), 0))
+ goto lose;
total_size += num_leaps * sizeof (struct leap);
- tzspec_len = (sizeof (time_t) == 8 && trans_width == 8
- ? st.st_size - (ftello (f)
- + num_transitions * (8 + 1)
- + num_types * 6
- + chars
- + num_leaps * 12
- + num_isstd
- + num_isgmt) - 1 : 0);
+ tzspec_len = 0;
+ if (sizeof (time_t) == 8 && trans_width == 8)
+ {
+ off_t rem = st.st_size - ftello (f);
+ if (__builtin_expect (rem < 0
+ || (size_t) rem < (num_transitions * (8 + 1)
+ + num_types * 6
+ + chars), 0))
+ goto lose;
+ tzspec_len = (size_t) rem - (num_transitions * (8 + 1)
+ + num_types * 6
+ + chars);
+ if (__builtin_expect (num_leaps > SIZE_MAX / 12
+ || tzspec_len < num_leaps * 12, 0))
+ goto lose;
+ tzspec_len -= num_leaps * 12;
+ if (__builtin_expect (tzspec_len < num_isstd, 0))
+ goto lose;
+ tzspec_len -= num_isstd;
+ if (__builtin_expect (tzspec == 0 || tzspec_len - 1 < num_isgmt, 0))
+ goto lose;
+ tzspec_len -= num_isgmt + 1;
+ if (__builtin_expect (SIZE_MAX - total_size < tzspec_len, 0))
+ goto lose;
+ }
+ if (__builtin_expect (SIZE_MAX - total_size - tzspec_len < extra, 0))
+ goto lose;
/* Allocate enough memory including the extra block requested by the
caller. */
And fix the previous patch ...
--- a/time/tzfile.c.orig 2011-12-19 10:58:26.000000000 +0100
+++ b/time/tzfile.c 2011-12-19 10:59:35.000000000 +0100
@@ -19,6 +19,7 @@
#include
#include
+#include
#include
#include
#include
@@ -278,7 +279,7 @@
if (__builtin_expect (tzspec_len < num_isstd, 0))
goto lose;
tzspec_len -= num_isstd;
- if (__builtin_expect (tzspec == 0 || tzspec_len - 1 < num_isgmt, 0))
+ if (__builtin_expect (tzspec_len == 0 || tzspec_len - 1 < num_isgmt, 0))
goto lose;
tzspec_len -= num_isgmt + 1;
if (__builtin_expect (SIZE_MAX - total_size < tzspec_len, 0))
continue with "q"...
Remember to have fun...
--
To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-commit+help@opensuse.org