Open
backport: fix out-of-bounds read in do_core_note (FreeBSD-style NT_PRPSINFO) #93
huijing_zhangAdd on 4 days ago
backport: fix out-of-bounds read in do_core_note (FreeBSD-style NT_PRPSINFO) #93
Open
Total: 2 files changed+46-1
| @@ -0,0 +1,42 @@ | |||
| 1 | +From 6bb1b445d5ed9127a0c5d73f1c7973fca4442b3f Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Christos Zoulas <christos@zoulas.com> | ||
| 3 | +Date: Fri, 24 Apr 2026 19:14:02 +0000 | ||
| 4 | +Subject: [PATCH] Add missing bounds check (Alexandru Hossu) | ||
| 5 | + | ||
| 6 | +Add missing bounds check in do_core_note(): before reading the | ||
| 7 | +81-byte argument name at nbuf + doff + argoff, check that the | ||
| 8 | +note description actually contains that range; otherwise reading | ||
| 9 | +a crafted short FreeBSD-style NT_PRPSINFO note runs past the | ||
| 10 | +note data (out-of-bounds read). | ||
| 11 | + | ||
| 12 | +(backported from upstream commit | ||
| 13 | +6bb1b445d5ed9127a0c5d73f1c7973fca4442b3f; adapted to file 5.45: | ||
| 14 | +the RCSID hunk is dropped and the context lines adjusted) | ||
| 15 | + | ||
| 16 | +Reference: https://github.com/file/file/commit/6bb1b445d5ed9127a0c5d73f1c7973fca4442b3f | ||
| 17 | + | ||
| 18 | +--- | ||
| 19 | + src/readelf.c | 6 +++++- | ||
| 20 | + 1 file changed, 6 insertions(+), 4 deletions(-) | ||
| 21 | + | ||
| 22 | +diff --git a/src/readelf.c b/src/readelf.c | ||
| 23 | +index 8d6a1b8..ff5c7fb 100644 | ||
| 24 | +--- a/src/readelf.c | ||
| 25 | ++++ b/src/readelf.c | ||
| 26 | +@@ -806,11 +806,13 @@ do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type, | ||
| 27 | + if (clazz == ELFCLASS32) | ||
| 28 | + argoff = 4 + 4 + 17; | ||
| 29 | + else | ||
| 30 | + argoff = 4 + 4 + 8 + 17; | ||
| 31 | +- if (file_printf(ms, ", from '%.80s'", nbuf + doff + | ||
| 32 | +- argoff) == -1) | ||
| 33 | +- return -1; | ||
| 34 | ++ if (doff + argoff + 81 <= size) { | ||
| 35 | ++ if (file_printf(ms, ", from '%.80s'", | ||
| 36 | ++ nbuf + doff + argoff) == -1) | ||
| 37 | ++ return -1; | ||
| 38 | ++ } | ||
| 39 | + pidoff = argoff + 81 + 2; | ||
| 40 | + if (doff + pidoff + 4 <= size) { | ||
| 41 | + if (file_printf(ms, ", pid=%u", | ||
| 42 | + elf_getu32(swap, *RCAST(uint32_t *, (nbuf + | ||
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: file | 1 | Name: file |
| 2 | Version: 5.45 | 2 | Version: 5.45 |
| 3 | -Release: 5 | 3 | +Release: 6 |
| 4 | Summary: A tool to identify the type of a particular file type | 4 | Summary: A tool to identify the type of a particular file type |
| 5 | License: BSD | 5 | License: BSD |
| 6 | URL: http://www.darwinsys.com/file/ | 6 | URL: http://www.darwinsys.com/file/ |
| @@ -8,6 +8,7 @@ Source0: ftp://ftp.astron.com/pub/file/file-%{version}.tar.gz | |||
| 8 | 8 | ||
| 9 | Patch1: 0001-file-localmagic.patch | 9 | Patch1: 0001-file-localmagic.patch |
| 10 | Patch2: 0002-Prevent-incorrect-result-for-nbytes-2GB-which-needs-.patch | 10 | Patch2: 0002-Prevent-incorrect-result-for-nbytes-2GB-which-needs-.patch |
| 11 | +Patch3: backport-elf-core-note-bounds.patch | ||
| 11 | 12 | ||
| 12 | Requires: %{name}-libs = %{version}-%{release} | 13 | Requires: %{name}-libs = %{version}-%{release} |
| 13 | BuildRequires: autoconf automake libtool zlib-devel make | 14 | BuildRequires: autoconf automake libtool zlib-devel make |
| @@ -134,6 +135,8 @@ make -C tests check | |||
| 134 | %{python3_sitelib}/__pycache__/* | 135 | %{python3_sitelib}/__pycache__/* |
| 135 | 136 | ||
| 136 | %changelog | 137 | %changelog |
| 138 | +* Tue Nov 03 2026 huijing_zhang <zhanghuijing@kylinos.cn> - 5.45-6 | ||
| 139 | +- backport fix for out-of-bounds read in do_core_note (FreeBSD-style NT_PRPSINFO) | ||
| 137 | * Wed Jul 15 2026 cenhuilin <cenhuilin@kylinos.cn> - 5.45-5 | 140 | * Wed Jul 15 2026 cenhuilin <cenhuilin@kylinos.cn> - 5.45-5 |
| 138 | - Prevent incorrect result for nbytes > 2GB | 141 | - Prevent incorrect result for nbytes > 2GB |
| 139 | 142 | ||