aboutsummaryrefslogtreecommitdiff
path: root/nixpkgs/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch
diff options
context:
space:
mode:
Diffstat (limited to 'nixpkgs/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch')
-rw-r--r--nixpkgs/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch62
1 files changed, 62 insertions, 0 deletions
diff --git a/nixpkgs/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch b/nixpkgs/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch
new file mode 100644
index 00000000000..75d874b93d0
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch
@@ -0,0 +1,62 @@
+From: Andreas Schwab <schwab@suse.de>
+Date: Wed, 19 Feb 2020 16:21:46 +0000 (+0100)
+Subject: Fix use-after-free in glob when expanding ~user (bug 25414)
+X-Git-Url: https://sourceware.org/git/?p=glibc.git;a=commitdiff_plain;h=da97c6b88eb03fb834e92964b0895c2ac8d61f63;hp=dd34bce38c822b67fcc42e73969bf6699d6874b6
+
+Fix use-after-free in glob when expanding ~user (bug 25414)
+
+The value of `end_name' points into the value of `dirname', thus don't
+deallocate the latter before the last use of the former.
+
+(cherry picked from commit ddc650e9b3dc916eab417ce9f79e67337b05035c)
+---
+
+diff --git a/posix/glob.c b/posix/glob.c
+index e73e35c510..c6cbd0eb43 100644
+--- a/posix/glob.c
++++ b/posix/glob.c
+@@ -827,31 +827,32 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
+ {
+ size_t home_len = strlen (p->pw_dir);
+ size_t rest_len = end_name == NULL ? 0 : strlen (end_name);
+- char *d;
++ char *d, *newp;
++ bool use_alloca = glob_use_alloca (alloca_used,
++ home_len + rest_len + 1);
+
+- if (__glibc_unlikely (malloc_dirname))
+- free (dirname);
+- malloc_dirname = 0;
+-
+- if (glob_use_alloca (alloca_used, home_len + rest_len + 1))
+- dirname = alloca_account (home_len + rest_len + 1,
+- alloca_used);
++ if (use_alloca)
++ newp = alloca_account (home_len + rest_len + 1, alloca_used);
+ else
+ {
+- dirname = malloc (home_len + rest_len + 1);
+- if (dirname == NULL)
++ newp = malloc (home_len + rest_len + 1);
++ if (newp == NULL)
+ {
+ scratch_buffer_free (&pwtmpbuf);
+ retval = GLOB_NOSPACE;
+ goto out;
+ }
+- malloc_dirname = 1;
+ }
+- d = mempcpy (dirname, p->pw_dir, home_len);
++ d = mempcpy (newp, p->pw_dir, home_len);
+ if (end_name != NULL)
+ d = mempcpy (d, end_name, rest_len);
+ *d = '\0';
+
++ if (__glibc_unlikely (malloc_dirname))
++ free (dirname);
++ dirname = newp;
++ malloc_dirname = !use_alloca;
++
+ dirlen = home_len + rest_len;
+ dirname_modified = 1;
+ }