From: "Yann E. MORIN" <yann.morin.1998@free.fr>
To: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: Joachim Wiberg <troglobit@gmail.com>, buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH 1/1] package/libconfuse: fix CVE-2022-40320
Date: Sun, 18 Sep 2022 21:50:30 +0200 [thread overview]
Message-ID: <20220918195030.GL1419013@scaer> (raw)
In-Reply-To: <20220918101317.171735-1-fontaine.fabrice@gmail.com>
Fabrice, All,
+Joachim, which I understand is now handling maintenance upstream
On 2022-09-18 12:13 +0200, Fabrice Fontaine spake thusly:
> cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer
> over-read.
>
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Applied to master, thanks.
Joachim, do you want to extend your entry in DEVELOPPERS with
libconfuse?
Regards,
Yann E. MORIN.
> ---
> ...rminated-username-used-with-getpwnam.patch | 43 +++++++++++++++++++
> package/libconfuse/libconfuse.mk | 3 ++
> 2 files changed, 46 insertions(+)
> create mode 100644 package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
>
> diff --git a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch b/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
> new file mode 100644
> index 0000000000..9ff3f5ec1c
> --- /dev/null
> +++ b/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
> @@ -0,0 +1,43 @@
> +From d73777c2c3566fb2647727bb56d9a2295b81669b Mon Sep 17 00:00:00 2001
> +From: Joachim Wiberg <troglobit@gmail.com>
> +Date: Fri, 2 Sep 2022 16:12:46 +0200
> +Subject: [PATCH] Fix #163: unterminated username used with getpwnam()
> +
> +Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
> +
> +[Retrieved (and backported) from:
> +https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b]
> +Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> +---
> + src/confuse.c | 10 ++++++----
> + 1 file changed, 6 insertions(+), 4 deletions(-)
> +
> +diff --git a/src/confuse.c b/src/confuse.c
> +index 6d1fdbd..05566b5 100644
> +--- a/src/confuse.c
> ++++ b/src/confuse.c
> +@@ -1894,18 +1894,20 @@ DLLIMPORT char *cfg_tilde_expand(const char *filename)
> + passwd = getpwuid(geteuid());
> + file = filename + 1;
> + } else {
> +- /* ~user or ~user/path */
> +- char *user;
> ++ char *user; /* ~user or ~user/path */
> ++ size_t len;
> +
> + file = strchr(filename, '/');
> + if (file == 0)
> + file = filename + strlen(filename);
> +
> +- user = malloc(file - filename);
> ++ len = file - filename - 1;
> ++ user = malloc(len + 1);
> + if (!user)
> + return NULL;
> +
> +- strncpy(user, filename + 1, file - filename - 1);
> ++ strncpy(user, &filename[1], len);
> ++ user[len] = 0;
> + passwd = getpwnam(user);
> + free(user);
> + }
> diff --git a/package/libconfuse/libconfuse.mk b/package/libconfuse/libconfuse.mk
> index 2beb0e4fbf..e7c2ef0a84 100644
> --- a/package/libconfuse/libconfuse.mk
> +++ b/package/libconfuse/libconfuse.mk
> @@ -14,5 +14,8 @@ LIBCONFUSE_LICENSE_FILES = LICENSE
> LIBCONFUSE_CPE_ID_VENDOR = libconfuse_project
> LIBCONFUSE_DEPENDENCIES = $(TARGET_NLS_DEPENDENCIES)
>
> +# 0001-Fix-163-unterminated-username-used-with-getpwnam.patch
> +LIBCONFUSE_IGNORE_CVES += CVE-2022-40320
> +
> $(eval $(autotools-package))
> $(eval $(host-autotools-package))
> --
> 2.35.1
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next prev parent reply other threads:[~2022-09-18 19:50 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-18 10:13 [Buildroot] [PATCH 1/1] package/libconfuse: fix CVE-2022-40320 Fabrice Fontaine
2022-09-18 19:50 ` Yann E. MORIN [this message]
2022-09-19 3:36 ` Joachim Wiberg
2022-09-29 15:13 ` Peter Korsgaard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220918195030.GL1419013@scaer \
--to=yann.morin.1998@free.fr \
--cc=buildroot@buildroot.org \
--cc=fontaine.fabrice@gmail.com \
--cc=troglobit@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox