Star0
10
Code
Code
Issues2
Pull Requests11
Discussion
Wiki
Analysis
Star0
10
Open
upstream: openEuler-22.03-LTS-SP3 - openEuler-22.03-LTS-SP3 #218
xuraoqingAdd on May 7
upstream: openEuler-22.03-LTS-SP3 - openEuler-22.03-LTS-SP3 #218
Open
xuraoqingAdd on May 7
Merged fromxuraoqing/audit-20260507115623upstream-sync-openEuler-22.03-LTS-SP3intosrc-openeuler/auditopenEuler-22.03-LTS-SP3
Total: 2 files changed+77-1
Maudit.spec+5-1
@@ -2,7 +2,7 @@ Summary: User space tools for kernel auditing
2Name: audit2Name: audit
3Epoch: 13Epoch: 1
4Version: 3.0.14Version: 3.0.1
5-Release: 215+Release: 22
6License: GPLv2+ and LGPLv2+6License: GPLv2+ and LGPLv2+
7URL: https://people.redhat.com/sgrubb/audit/7URL: https://people.redhat.com/sgrubb/audit/
8Source0: https://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz8Source0: https://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
@@ -93,6 +93,7 @@ Patch81: backport-Modify-ausearch-checkpoint-code-to-address-audit-use.p
93Patch82: backport-Update-_get_hostname-436.patch93Patch82: backport-Update-_get_hostname-436.patch
94Patch83: backport-If-we-are-checkpointing-decide-if-we-output-this-eve.patch94Patch83: backport-If-we-are-checkpointing-decide-if-we-output-this-eve.patch
95Patch84: backport-Release-queue-mutexes-during-teardown.patch95Patch84: backport-Release-queue-mutexes-during-teardown.patch
96+Patch6000: backport-Harden-against-a-couple-memory-issues.patch
96 97 
97BuildRequires: gcc swig libtool systemd kernel-headers >= 2.6.2998BuildRequires: gcc swig libtool systemd kernel-headers >= 2.6.29
98BuildRequires: openldap-devel krb5-devel libcap-ng-devel99BuildRequires: openldap-devel krb5-devel libcap-ng-devel
@@ -428,6 +429,9 @@ fi
428%attr(644,root,root) %{_mandir}/man8/*.8.gz429%attr(644,root,root) %{_mandir}/man8/*.8.gz
429 430 
430%changelog431%changelog
432+* Thu May 07 2026 Xu Raoqing <xuraoqing@h-partners.com> - 1:3.0.1-22
433+- Apply patch: backport-Harden-against-a-couple-memory-issues.patch
434+ 
431* Mon Oct 20 2025 Linux_zhang <zhangruifang@h-partners.com> - 1:3.0.1-21435* Mon Oct 20 2025 Linux_zhang <zhangruifang@h-partners.com> - 1:3.0.1-21
432- backport patch from upstream436- backport patch from upstream
433 437
Abackport-Harden-against-a-couple-memory-issues.patch+72-0
@@ -0,0 +1,72 @@
1+From c9d23011a36d4d439034cd47a66af6809b550ab3 Mon Sep 17 00:00:00 2001
2+From: Steve Grubb <ausearch.1@gmail.com>
3+Date: Sat, 15 Nov 2025 12:35:51 -0500
4+Subject: [PATCH] Harden against a couple memory issues
5+ 
6+Hardened plist_append to free the freshly allocated node when duplicating the plugin configuration fails, avoiding a dangling pointer assignment.
7+ 
8+Updated cleanup_event to respect the optional event_is_prealloc hook before freeing events, preventing accidental frees of pooled objects.
9+ 
10+Ensured client messages are NUL-terminated within buffer bounds by clamping the termination index before modifying the header buffer.
11+---
12+ audisp/audispd-llist.c | 8 ++++++--
13+ src/auditd-event.c | 4 +++-
14+ src/auditd-listen.c | 17 ++++++++++++-----
15+ 3 files changed, 21 insertions(+), 8 deletions(-)
16+ 
17+diff --git a/audisp/audispd-llist.c b/audisp/audispd-llist.c
18+index 30d7f03..ad22627 100644
19+--- a/audisp/audispd-llist.c
20++++ b/audisp/audispd-llist.c
21+@@ -81,9 +81,13 @@ void plist_append(conf_llist *l, plugin_conf_t *p)
22+
23+ if (p) {
24+ void *pp = malloc(sizeof(struct plugin_conf));
25+- if (pp)
26++ if (pp) {
27+ memcpy(pp, p, sizeof(struct plugin_conf));
28+- newnode->p = pp;
29++ newnode->p = pp;
30++ } else {
31++ free(newnode);
32++ return 1;
33++ }
34+ } else
35+ newnode->p = NULL;
36+
37+diff --git a/src/auditd-listen.c b/src/auditd-listen.c
38+index bcd62ca..26a37ef 100644
39+--- a/src/auditd-listen.c
40++++ b/src/auditd-listen.c
41+@@ -558,10 +558,17 @@ static void client_message (struct ev_tcp *io, unsigned int length,
42+ if (AUDIT_RMW_IS_MAGIC (header, length)) {
43+ AUDIT_RMW_UNPACK_HEADER (header, hver, mver, type, mlen, seq)
44+
45+- ch = header[length];
46+- header[length] = 0;
47+- if (length > 1 && header[length-1] == '\n')
48+- header[length-1] = 0;
49++ size_t term_idx;
50++
51++ if (length >= MAX_AUDIT_MESSAGE_LENGTH)
52++ term_idx = MAX_AUDIT_MESSAGE_LENGTH - 1;
53++ else
54++ term_idx = length;
55++
56++ ch = header[term_idx];
57++ header[term_idx] = 0;
58++ if (term_idx > 1 && header[term_idx-1] == '\n')
59++ header[term_idx-1] = 0;
60+ if (type == AUDIT_RMW_TYPE_HEARTBEAT) {
61+ unsigned char ack[AUDIT_RMW_HEADER_SIZE];
62+ AUDIT_RMW_PACK_HEADER (ack, 0, AUDIT_RMW_TYPE_ACK,
63+@@ -574,7 +581,7 @@ static void client_message (struct ev_tcp *io, unsigned int length,
64+ if (e)
65+ distribute_event(e);
66+ }
67+- header[length] = ch;
68++ header[term_idx] = ch;
69+ }
70+ }
71+
72+