mirror of
https://git.yoctoproject.org/poky
synced 2026-02-10 18:53:13 +01:00
fbc735796f
* CVE-2018-11233 Code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory. Affects < 2.17.1 CVE: CVE-2018-11233 Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1583888 (From OE-Core rev: d145f605c274386baf0dde023f15cddf37523f3b) Signed-off-by: Sinan Kaya <okaya@kernel.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
45 lines
1.5 KiB
Diff
45 lines
1.5 KiB
Diff
From 014281e62b7920a6d710a85089e00ca012b0744c Mon Sep 17 00:00:00 2001
|
|
From: Jeff King <peff@peff.net>
|
|
Date: Sun, 13 May 2018 12:09:42 -0400
|
|
Subject: [PATCH] is_ntfs_dotgit: use a size_t for traversing string
|
|
|
|
We walk through the "name" string using an int, which can
|
|
wrap to a negative value and cause us to read random memory
|
|
before our array (e.g., by creating a tree with a name >2GB,
|
|
since "int" is still 32 bits even on most 64-bit platforms).
|
|
Worse, this is easy to trigger during the fsck_tree() check,
|
|
which is supposed to be protecting us from malicious
|
|
garbage.
|
|
|
|
Note one bit of trickiness in the existing code: we
|
|
sometimes assign -1 to "len" at the end of the loop, and
|
|
then rely on the "len++" in the for-loop's increment to take
|
|
it back to 0. This is still legal with a size_t, since
|
|
assigning -1 will turn into SIZE_MAX, which then wraps
|
|
around to 0 on increment.
|
|
|
|
Signed-off-by: Jeff King <peff@peff.net>
|
|
CVE: CVE-2018-11233
|
|
Upstream-Status: Backport[https://github.com/git/git/commit/11a9f4d807a0d71dc6eff51bb87baf4ca2cccf1d]
|
|
Signed-off-by: Sinan Kaya <okaya@kernel.org>
|
|
---
|
|
path.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/path.c b/path.c
|
|
index da8b65573..d31c795ff 100644
|
|
--- a/path.c
|
|
+++ b/path.c
|
|
@@ -1305,7 +1305,7 @@ static int only_spaces_and_periods(const char *path, size_t len, size_t skip)
|
|
|
|
int is_ntfs_dotgit(const char *name)
|
|
{
|
|
- int len;
|
|
+ size_t len;
|
|
|
|
for (len = 0; ; len++)
|
|
if (!name[len] || name[len] == '\\' || is_dir_sep(name[len])) {
|
|
--
|
|
2.19.0
|
|
|