mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-27 03:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

openssh: fix potential signed overflow in pointer arithmatic

Browse Source 
Pointer arithmatic results in implementation defined signed integer
type, so that 'd - dst’ in strlcat may trigger signed overflow if
pointer ‘d’ is near 0x7fffffff in 32 bits system. In case of ompilation
by gcc or clang with -ftrapv option, the overflow would generate
program abort.

(From OE-Core rev: 1c4b8d797c76a08ebd1658066e9d32972b6abe58)

Signed-off-by: hguo3 <heng.guo@windriver.com>
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Hongxu Jia
2019-06-16 22:17:41 -04:00
committed by Richard Purdie
parent 27d60c5a81
commit 5758817444
1 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch
View File

@@ -11,14 +11,17 @@ would lead to program abort.
Upstream-Status: Submitted [http://bugzilla.mindrot.org/show_bug.cgi?id=2608]
Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
Complete the fix
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
openbsd-compat/strlcat.c | 8 ++++++--
openbsd-compat/strlcpy.c | 8 ++++++--
openbsd-compat/strnlen.c | 8 ++++++--
3 files changed, 18 insertions(+), 6 deletions(-)
openbsd-compat/strlcat.c | 10 +++++++---
openbsd-compat/strlcpy.c | 8 ++++++--
openbsd-compat/strnlen.c | 8 ++++++--
3 files changed, 19 insertions(+), 7 deletions(-)
diff --git a/openbsd-compat/strlcat.c b/openbsd-compat/strlcat.c
index bcc1b61..e758ebf 100644
index bcc1b61..124e1e3 100644
--- a/openbsd-compat/strlcat.c
+++ b/openbsd-compat/strlcat.c
@@ -23,6 +23,7 @@
@@ -29,6 +32,15 @@ index bcc1b61..e758ebf 100644
/*
* Appends src to string dst of size siz (unlike strncat, siz is the
@@ -42,7 +43,7 @@ strlcat(char *dst, const char *src, size_t siz)
/* Find the end of dst and adjust bytes left but don't go past end */
while (n-- != 0 && *d != '\0')
d++;
- dlen = d - dst;
+ dlen = (uintptr_t)d - (uintptr_t)dst;
n = siz - dlen;
if (n == 0)
@@ -55,8 +56,11 @@ strlcat(char *dst, const char *src, size_t siz)
s++;
}
@@ -70,7 +82,7 @@ index b4b1b60..b06f374 100644
#endif /* !HAVE_STRLCPY */
diff --git a/openbsd-compat/strnlen.c b/openbsd-compat/strnlen.c
index 93d5155..9b8de5d 100644
index 7ad3573..7040f1f 100644
--- a/openbsd-compat/strnlen.c
+++ b/openbsd-compat/strnlen.c
@@ -23,6 +23,7 @@
@@ -95,5 +107,5 @@ index 93d5155..9b8de5d 100644
}
#endif
--
1.9.1
2.17.1