wok-current view glibc/stuff/CVE-2024-33600-2.patch @ rev 25728

Merge wok for both arch and few updates
author Stanislas Leduc <shann@slitaz.org>
date Thu Dec 05 08:39:45 2024 +0000 (9 months ago)
parents
children
line source
1 From e3eef1b8fbdd3a7917af466ca9c4b7477251ca79 Mon Sep 17 00:00:00 2001
2 From: Florian Weimer <fweimer@redhat.com>
3 Date: Thu, 25 Apr 2024 15:01:07 +0200
4 Subject: [PATCH] CVE-2024-33600: nscd: Avoid null pointer crashes after
5 notfound response (bug 31678)
6
7 The addgetnetgrentX call in addinnetgrX may have failed to produce
8 a result, so the result variable in addinnetgrX can be NULL.
9 Use db->negtimeout as the fallback value if there is no result data;
10 the timeout is also overwritten below.
11
12 Also avoid sending a second not-found response. (The client
13 disconnects after receiving the first response, so the data stream did
14 not go out of sync even without this fix.) It is still beneficial to
15 add the negative response to the mapping, so that the client can get
16 it from there in the future, instead of going through the socket.
17
18 Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
19 (cherry picked from commit b048a482f088e53144d26a61c390bed0210f49f2)
20 ---
21 nscd/netgroupcache.c | 11 +++++++----
22 1 file changed, 7 insertions(+), 4 deletions(-)
23
24 diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c
25 index f2e7d60b50e..aa9501a2c05 100644
26 --- a/nscd/netgroupcache.c
27 +++ b/nscd/netgroupcache.c
28 @@ -512,14 +512,15 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req,
29
30 datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len,
31 sizeof (innetgroup_response_header),
32 - he == NULL ? 0 : dh->nreloads + 1, result->head.ttl);
33 + he == NULL ? 0 : dh->nreloads + 1,
34 + result == NULL ? db->negtimeout : result->head.ttl);
35 /* Set the notfound status and timeout based on the result from
36 getnetgrent. */
37 - dataset->head.notfound = result->head.notfound;
38 + dataset->head.notfound = result == NULL || result->head.notfound;
39 dataset->head.timeout = timeout;
40
41 dataset->resp.version = NSCD_VERSION;
42 - dataset->resp.found = result->resp.found;
43 + dataset->resp.found = result != NULL && result->resp.found;
44 /* Until we find a matching entry the result is 0. */
45 dataset->resp.result = 0;
46
47 @@ -567,7 +568,9 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req,
48 goto out;
49 }
50
51 - if (he == NULL)
52 + /* addgetnetgrentX may have already sent a notfound response. Do
53 + not send another one. */
54 + if (he == NULL && dataset->resp.found)
55 {
56 /* We write the dataset before inserting it to the database
57 since while inserting this thread might block and so would