Open
backport: NUL terminate CDF directory name passed to cdf_app_to_mime [openEuler-26.09] #96
huijing_zhangAdd on 4 days ago
backport: NUL terminate CDF directory name passed to cdf_app_to_mime [openEuler-26.09] #96
Open
Total: 3 files changed+88-1
| @@ -0,0 +1,39 @@ | |||
| 1 | +From 029e5bae7362e71671b3e1f316d4f3936d8a7819 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Christos Zoulas <christos@zoulas.com> | ||
| 3 | +Date: Tue, 13 Oct 2026 15:54:12 +0000 | ||
| 4 | +Subject: [PATCH] PR/812: mgl: NUL terminate string passed to cdf_app_to_mime() | ||
| 5 | + | ||
| 6 | +NUL terminate the CDF directory name before passing it to | ||
| 7 | +cdf_app_to_mime(), which uses strcasestr() on it; otherwise a | ||
| 8 | +32-character (no NUL) directory name causes an out-of-bounds | ||
| 9 | +stack read. | ||
| 10 | + | ||
| 11 | +(backported from upstream commit | ||
| 12 | +029e5bae7362e71671b3e1f316d4f3936d8a7819; adapted to file 5.45: | ||
| 13 | +the RCSID hunk is dropped) | ||
| 14 | + | ||
| 15 | +--- | ||
| 16 | +diff --git a/src/readcdf.c b/src/readcdf.c | ||
| 17 | +index 30c3d24..19a4414 100644 | ||
| 18 | +--- a/src/readcdf.c | ||
| 19 | ++++ b/src/readcdf.c | ||
| 20 | +@@ -392,7 +392,7 @@ cdf_check_summary_info(struct magic_set *ms, const cdf_info_t *info, | ||
| 21 | + int i; | ||
| 22 | + const char *str = NULL; | ||
| 23 | + cdf_directory_t *d; | ||
| 24 | +- char name[__arraycount(d->d_name)]; | ||
| 25 | ++ char name[__arraycount(d->d_name) + 1]; | ||
| 26 | + size_t j, k; | ||
| 27 | + | ||
| 28 | + #ifdef CDF_DEBUG | ||
| 29 | +@@ -406,8 +406,9 @@ cdf_check_summary_info(struct magic_set *ms, const cdf_info_t *info, | ||
| 30 | + return i; | ||
| 31 | + for (j = 0; str == NULL && j < dir->dir_len; j++) { | ||
| 32 | + d = &dir->dir_tab[j]; | ||
| 33 | +- for (k = 0; k < sizeof(name); k++) | ||
| 34 | ++ for (k = 0; k < sizeof(name) - 1; k++) | ||
| 35 | + name[k] = CAST(char, cdf_tole2(d->d_name[k])); | ||
| 36 | ++ name[sizeof(name) - 1] = '\0'; | ||
| 37 | + str = cdf_app_to_mime(name, | ||
| 38 | + NOTMIME(ms) ? name2desc : name2mime); | ||
| 39 | + } | ||
| @@ -0,0 +1,42 @@ | |||
| 1 | +From 6bb1b445d5ed9127a0c5d73f1c7973fca4442b3f Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Christos Zoulas <christos@zoulas.com> | ||
| 3 | +Date: Fri, 24 Apr 2026 19:14:02 +0000 | ||
| 4 | +Subject: [PATCH] Add missing bounds check (Alexandru Hossu) | ||
| 5 | + | ||
| 6 | +Add missing bounds check in do_core_note(): before reading the | ||
| 7 | +81-byte argument name at nbuf + doff + argoff, check that the | ||
| 8 | +note description actually contains that range; otherwise reading | ||
| 9 | +a crafted short FreeBSD-style NT_PRPSINFO note runs past the | ||
| 10 | +note data (out-of-bounds read). | ||
| 11 | + | ||
| 12 | +(backported from upstream commit | ||
| 13 | +6bb1b445d5ed9127a0c5d73f1c7973fca4442b3f; adapted to file 5.45: | ||
| 14 | +the RCSID hunk is dropped and the context lines adjusted) | ||
| 15 | + | ||
| 16 | +Reference: https://github.com/file/file/commit/6bb1b445d5ed9127a0c5d73f1c7973fca4442b3f | ||
| 17 | + | ||
| 18 | +--- | ||
| 19 | + src/readelf.c | 6 +++++- | ||
| 20 | + 1 file changed, 6 insertions(+), 4 deletions(-) | ||
| 21 | + | ||
| 22 | +diff --git a/src/readelf.c b/src/readelf.c | ||
| 23 | +index 8d6a1b8..ff5c7fb 100644 | ||
| 24 | +--- a/src/readelf.c | ||
| 25 | ++++ b/src/readelf.c | ||
| 26 | +@@ -806,11 +806,13 @@ do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type, | ||
| 27 | + if (clazz == ELFCLASS32) | ||
| 28 | + argoff = 4 + 4 + 17; | ||
| 29 | + else | ||
| 30 | + argoff = 4 + 4 + 8 + 17; | ||
| 31 | +- if (file_printf(ms, ", from '%.80s'", nbuf + doff + | ||
| 32 | +- argoff) == -1) | ||
| 33 | +- return -1; | ||
| 34 | ++ if (doff + argoff + 81 <= size) { | ||
| 35 | ++ if (file_printf(ms, ", from '%.80s'", | ||
| 36 | ++ nbuf + doff + argoff) == -1) | ||
| 37 | ++ return -1; | ||
| 38 | ++ } | ||
| 39 | + pidoff = argoff + 81 + 2; | ||
| 40 | + if (doff + pidoff + 4 <= size) { | ||
| 41 | + if (file_printf(ms, ", pid=%u", | ||
| 42 | + elf_getu32(swap, *RCAST(uint32_t *, (nbuf + | ||
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: file | 1 | Name: file |
| 2 | Version: 5.45 | 2 | Version: 5.45 |
| 3 | -Release: 5 | 3 | +Release: 7 |
| 4 | Summary: A tool to identify the type of a particular file type | 4 | Summary: A tool to identify the type of a particular file type |
| 5 | License: BSD | 5 | License: BSD |
| 6 | URL: http://www.darwinsys.com/file/ | 6 | URL: http://www.darwinsys.com/file/ |
| @@ -8,6 +8,8 @@ Source0: ftp://ftp.astron.com/pub/file/file-%{version}.tar.gz | |||
| 8 | 8 | ||
| 9 | Patch1: 0001-file-localmagic.patch | 9 | Patch1: 0001-file-localmagic.patch |
| 10 | Patch2: 0002-Prevent-incorrect-result-for-nbytes-2GB-which-needs-.patch | 10 | Patch2: 0002-Prevent-incorrect-result-for-nbytes-2GB-which-needs-.patch |
| 11 | +Patch3: backport-elf-core-note-bounds.patch | ||
| 12 | +Patch4: backport-cdf-name-nul-terminate.patch | ||
| 11 | 13 | ||
| 12 | Requires: %{name}-libs = %{version}-%{release} | 14 | Requires: %{name}-libs = %{version}-%{release} |
| 13 | BuildRequires: autoconf automake libtool zlib-devel make | 15 | BuildRequires: autoconf automake libtool zlib-devel make |
| @@ -134,6 +136,10 @@ make -C tests check | |||
| 134 | %{python3_sitelib}/__pycache__/* | 136 | %{python3_sitelib}/__pycache__/* |
| 135 | 137 | ||
| 136 | %changelog | 138 | %changelog |
| 139 | +* Wed Nov 04 2026 huijing_zhang <zhanghuijing@kylinos.cn> - 5.45-7 | ||
| 140 | +- NUL terminate CDF directory name before cdf_app_to_mime (fix OOB stack read) | ||
| 141 | +* Tue Nov 03 2026 huijing_zhang <zhanghuijing@kylinos.cn> - 5.45-6 | ||
| 142 | +- backport fix for out-of-bounds read in do_core_note (FreeBSD-style NT_PRPSINFO) | ||
| 137 | * Wed Jul 15 2026 cenhuilin <cenhuilin@kylinos.cn> - 5.45-5 | 143 | * Wed Jul 15 2026 cenhuilin <cenhuilin@kylinos.cn> - 5.45-5 |
| 138 | - Prevent incorrect result for nbytes > 2GB | 144 | - Prevent incorrect result for nbytes > 2GB |
| 139 | 145 | ||