fix silly getmntent() bug
cover fix silly getmntent() bug
This is a backport of a bug in getmntent() which we were only actually bitten by on MIPS, but which is clearly a real bug on most targets, where empty lines can cause buffer underrun. Just a backport of upstream patch. Verified to fix observed failure.
The following changes since commit 80b3974081c4a8c604e23982a6db8fb32c616058:
sstate: Ensure siginfo and sig files are also touched (2015-11-25 08:08:51 +0000)
are available in the git repository at:
git://git.yoctoproject.org/poky-contrib seebs/getmntent
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=seebs/getmntent
Peter Seebach (1):
glibc/0029-fix-getmnt-empty-lines.patch: fix getmntent()
.../glibc/0029-fix-getmntent-empty-lines.patch | 40 ++++++++++++++++++++++ meta/recipes-core/glibc/glibc_2.22.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0029-fix-getmntent-empty-lines.patch
Signature · 1 line
2.3.1
PATCH 1/1 glibc/0029-fix-getmnt-empty-lines.patch: fix getmntent()
When confronted with an empty line, getmntent() can underrun a buffer, possibly doing very strange things if it finds additional space/tab characters. Backport the upstream fix.
--- .../glibc/0029-fix-getmntent-empty-lines.patch | 40 ++++++++++++++++++++++ meta/recipes-core/glibc/glibc_2.22.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0029-fix-getmntent-empty-lines.patch
meta/recipes-core/glibc/glibc/0029-fix-getmntent-empty-lines.patch new file +40 -0
@@ -0,0 +1,40 @@ +From b0e805fa0d6fea33745952df7b7f5442ca4c374f Mon Sep 17 00:00:00 2001 +From: Mike Frysinger <[email protected]> +Date: Fri, 28 Aug 2015 17:08:49 -0400 +Subject: [PATCH] getmntent: fix memory corruption w/blank lines [BZ #18887] + +The fix for BZ #17273 introduced a single byte of memory corruption when +the line is entirely blank. It would walk back past the start of the +buffer if the heap happened to be 0x20 or 0x09 and then write a NUL byte. + buffer = '\n'; + end_ptr = buffer; + while (end_ptr[-1] == ' ' || end_ptr[-1] == '\t') + end_ptr--; + *end_ptr = '\0'; + +Fix that and rework the tests. Adding the testcase for BZ #17273 to the +existing \040 parser does not really make sense as it's unrelated, and +leads to confusing behavior: it implicitly relies on the new entry being +longer than the previous entry (since it just rewinds the FILE*). Split +it out into its own dedicated testcase instead. + +The original patch is at link https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=patch;h=b0e805fa0d6fea33745952df7b7f5442ca4c374f. +Only code to mntent_r.c is kept in this patch, Change log, NEWS, Makefile, and test cases are excluded. + +Upstream-status: upstreamed to 2.23 +Signed-off-by: Baoshan Pang <[email protected]> + +diff --git a/misc/mntent_r.c b/misc/mntent_r.c +index 6159873..19af8a8 100644 +--- a/misc/mntent_r.c ++++ b/misc/mntent_r.c +@@ -136,7 +136,8 @@ __getmntent_r (FILE *stream, struct mntent *mp, char *buffer, int bufsiz) + end_ptr = strchr (buffer, '\n'); + if (end_ptr != NULL) /* chop newline */ + { +- while (end_ptr[-1] == ' ' || end_ptr[-1] == '\t') ++ while (end_ptr != buffer ++ && (end_ptr[-1] == ' ' || end_ptr[-1] == '\t')) + end_ptr--; + *end_ptr = '\0'; + }
meta/recipes-core/glibc/glibc_2.22.bb +1 -0
@@ -40,6 +40,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0027-eglibc-use-option-groups-Conditionally-exclude-c-tes.patch \ file://nscd-no-bash.patch \ file://0028-Clear-ELF_RTYPE_CLASS_EXTERN_PROTECTED_DATA-for-prel.patch \ + file://0029-fix-getmntent-empty-lines.patch \ " SRC_URI += "\
Signature · 1 line
2.3.1
Re: [PATCH 1/1] glibc/0029-fix-getmnt-empty-lines.patch: fix getmntent()
Quoted 2 lines · Peter Seebach
+Upstream-status: upstreamed to 2.23
I've fixed this whilst merging to my staging branch but we're building tooling around Upstream-Status so using the defined values would be appreciated. So in this case, "Upstream-Status: Backport (upstreamed to 2.23)" would be correct.
Ross