Star0
12
代码
代码
Issues35
Pull Requests3
项目讨论
Wiki
分析
Star0
12
已开启
fix(cve): 修复 CVE-2026-43620 在 rsync 中的漏洞 #87
infra_team创建于 5月20日
fix(cve): 修复 CVE-2026-43620 在 rsync 中的漏洞 #87
已开启
infra_team创建于 5月20日
从infra_team/rsyncfix-CVE-2026-43620-openEuler-24.03-LTS合入到src-openeuler/rsyncopenEuler-24.03-LTS
共 2 个文件变更+99-2
Abackport-CVE-2026-43620.patch+93-0
@@ -0,0 +1,93 @@
1+From: Andrew Tridgell <andrew@tridgell.net>
2+Date: Tue, 5 May 2026 16:48:16 +1000
3+Subject: [PATCH] receiver: add parent_ndx<0 guard, mirroring 797e17f
4+ 
5+CVE-2026-43620 - fix out-of-bounds array read in recv_files()
6+ 
7+Commit 797e17f ("fixed an invalid access to files array") added a
8+parent_ndx < 0 guard to send_files() in sender.c, but the visually-
9+identical block in recv_files() in receiver.c was not updated. A
10+malicious rsync:// server can therefore drive any connecting client
11+into the same out-of-bounds dir_flist->files[-1] read followed by a
12+file_struct dereference in f_name() one line later.
13+ 
14+Apply the same guard receiver-side. This patch adds ndx < flist->ndx_start
15+checks to prevent out-of-bounds array access.
16+ 
17+Upstream-commit: https://github.com/RsyncProject/rsync/commit/0cf200ecbb8baaf58070d825c4fbd892b4a63b69
18+Signed-off-by: infra_team <zhaiwenjie1@huawei.com>
19+ 
20+diff --git a/generator.c b/generator.c
21+index 21c4a59..9c01bf3 100644
22+--- a/generator.c
23++++ b/generator.c
24+@@ -2142,6 +2142,8 @@ void check_for_finished_files(int itemizing, enum logcode code, int check_redo)
25+ if (send_failed)
26+ ndx = get_hlink_num();
27+ flist = flist_for_ndx(ndx, "check_for_finished_files.1");
28++ if (ndx < flist->ndx_start)
29++ exit_cleanup(RERR_PROTOCOL);
30+ file = flist->files[ndx - flist->ndx_start];
31+ assert(file->flags & FLAG_HLINKED);
32+ if (send_failed)
33+@@ -2170,6 +2172,8 @@ void check_for_finished_files(int itemizing, enum logcode code, int check_redo)
34+ 
35+ flist = cur_flist;
36+ cur_flist = flist_for_ndx(ndx, "check_for_finished_files.2");
37++ if (ndx < cur_flist->ndx_start)
38++ exit_cleanup(RERR_PROTOCOL);
39+ 
40+ file = cur_flist->files[ndx - cur_flist->ndx_start];
41+ if (solo_file)
42+diff --git a/io.c b/io.c
43+index a99ac0e..f760d4d 100644
44+--- a/io.c
45++++ b/io.c
46+@@ -1089,6 +1089,9 @@ static void got_flist_entry_status(enum festatus status, int ndx)
47+ {
48+ struct file_list *flist = flist_for_ndx(ndx, "got_flist_entry_status");
49+ 
50++ if (ndx < flist->ndx_start)
51++ exit_cleanup(RERR_PROTOCOL);
52++
53+ if (remove_source_files) {
54+ active_filecnt--;
55+ active_bytecnt -= F_LENGTH(flist->files[ndx - flist->ndx_start]);
56+diff --git a/receiver.c b/receiver.c
57+index c9d7e01..bf47fc2 100644
58+--- a/receiver.c
59++++ b/receiver.c
60+@@ -451,7 +451,10 @@ static void handle_delayed_updates(char *local_name)
61+ static void no_batched_update(int ndx, BOOL is_redo)
62+ {
63+ struct file_list *flist = flist_for_ndx(ndx, "no_batched_update");
64+- struct file_struct *file = flist->files[ndx - flist->ndx_start];
65++ struct file_struct *file;
66++ if (ndx < flist->ndx_start)
67++ exit_cleanup(RERR_PROTOCOL);
68++ file = flist->files[ndx - flist->ndx_start];
69+ 
70+ rprintf(FERROR_XFER, "(No batched update for%s \"%s\")\n",
71+ is_redo ? " resend of" : "", f_name(file, NULL));
72+@@ -586,6 +589,8 @@ int recv_files(int f_in, int f_out, char *local_name)
73+ 
74+ if (ndx - cur_flist->ndx_start >= 0)
75+ file = cur_flist->files[ndx - cur_flist->ndx_start];
76++ else if (cur_flist->parent_ndx < 0)
77++ exit_cleanup(RERR_PROTOCOL);
78+ else
79+ file = dir_flist->files[cur_flist->parent_ndx];
80+ fname = local_name ? local_name : f_name(file, fbuf);
81+diff --git a/sender.c b/sender.c
82+index 3d4f052..a7bb35b 100644
83+--- a/sender.c
84++++ b/sender.c
85+@@ -136,6 +136,8 @@ void successful_send(int ndx)
86+ return;
87+ 
88+ flist = flist_for_ndx(ndx, "successful_send");
89++ if (ndx < flist->ndx_start)
90++ exit_cleanup(RERR_PROTOCOL);
91+ file = flist->files[ndx - flist->ndx_start];
92+ if (!change_pathname(file, NULL, 0))
93+ return;
Mrsync.spec+6-2
@@ -1,6 +1,6 @@
1Name: rsync1Name: rsync
2Version: 3.2.72Version: 3.2.7
3-Release: 83+Release: 9
4Summary: Fast incremental file transfer utility4Summary: Fast incremental file transfer utility
5License: GPL-3.0-or-later5License: GPL-3.0-or-later
6URL: http://rsync.samba.org/6URL: http://rsync.samba.org/
@@ -28,6 +28,7 @@ Patch6013: backport-Fix_use-after-free_in_generator.patch
28Patch6014: backport-Fix-FLAG_GOT_DIR_FLIST-collission-with-FLAG_HLINKED.patch28Patch6014: backport-Fix-FLAG_GOT_DIR_FLIST-collission-with-FLAG_HLINKED.patch
29Patch6015: backport-CVE-2025-10158.patch29Patch6015: backport-CVE-2025-10158.patch
30Patch6016: backport-CVE-2026-41035.patch30Patch6016: backport-CVE-2026-41035.patch
31+Patch6017: backport-CVE-2026-43620.patch
31 32 
32BuildRequires: git gcc systemd libacl-devel libattr-devel autoconf popt-devel33BuildRequires: git gcc systemd libacl-devel libattr-devel autoconf popt-devel
33BuildRequires: lz4-devel openssl-devel libzstd-devel34BuildRequires: lz4-devel openssl-devel libzstd-devel
@@ -102,6 +103,9 @@ install -D -m644 %{SOURCE5} %{buildroot}/%{_unitdir}/rsyncd@.service
102%{_mandir}/man5/rsyncd.conf.5*103%{_mandir}/man5/rsyncd.conf.5*
103 104 
104%changelog105%changelog
106+* Wed May 20 2026 infra_team <zhaiwenjie1@huawei.com> - 3.2.7-9
107+- Fix CVE-2026-43620
108+ 
105* Wed Apr 22 2026 hugel <2712504175@qq.com> - 3.2.7-8109* Wed Apr 22 2026 hugel <2712504175@qq.com> - 3.2.7-8
106- Fix CVE-2026-41035110- Fix CVE-2026-41035
107 111 
@@ -112,7 +116,7 @@ install -D -m644 %{SOURCE5} %{buildroot}/%{_unitdir}/rsyncd@.service
112- fix CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087,116- fix CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087,
113 CVE-2024-12088, CVE-2024-12747117 CVE-2024-12088, CVE-2024-12747
114 118 
115-* Wed Oct 9 zhoupengcheng <zhoupengcheng11@huawei.com> - 3.2.7-5119+* Wed Oct 09 2024 zhoupengcheng <zhoupengcheng11@huawei.com> - 3.2.7-5
116- backport patch from upstream120- backport patch from upstream
117 121 
118* Thu Jul 11 2024 Wenhua Huang <huangwenhua@kylinos.cn> - 3.2.7-4122* Thu Jul 11 2024 Wenhua Huang <huangwenhua@kylinos.cn> - 3.2.7-4