e2fsprogs: fix the CVE-2015-1572
Backport a patch to fix CVE-2015-1572 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1572 (From OE-Core rev: 203e1024cc7517cad28423cc04f641376cc8f2f5) Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
parent
781cd0dc68
commit
3176510ee7
|
@ -0,0 +1,58 @@
|
|||
From 49d0fe2a14f2a23da2fe299643379b8c1d37df73 Mon Sep 17 00:00:00 2001
|
||||
From: Theodore Ts'o <tytso@mit.edu>
|
||||
Date: Fri, 6 Feb 2015 12:46:39 -0500
|
||||
Subject: [PATCH] libext2fs: fix potential buffer overflow in closefs()
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
The bug fix in f66e6ce4446: "libext2fs: avoid buffer overflow if
|
||||
s_first_meta_bg is too big" had a typo in the fix for
|
||||
ext2fs_closefs(). In practice most of the security exposure was from
|
||||
the openfs path, since this meant if there was a carefully crafted
|
||||
file system, buffer overrun would be triggered when the file system was
|
||||
opened.
|
||||
|
||||
However, if corrupted file system didn't trip over some corruption
|
||||
check, and then the file system was modified via tune2fs or debugfs,
|
||||
such that the superblock was marked dirty and then written out via the
|
||||
closefs() path, it's possible that the buffer overrun could be
|
||||
triggered when the file system is closed.
|
||||
|
||||
Also clear up a signed vs unsigned warning while we're at it.
|
||||
|
||||
Thanks to Nick Kralevich <nnk@google.com> for asking me to look at
|
||||
compiler warning in the code in question, which led me to notice the
|
||||
bug in f66e6ce4446.
|
||||
|
||||
Addresses: CVE-2015-1572
|
||||
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
---
|
||||
lib/ext2fs/closefs.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/lib/ext2fs/closefs.c b/lib/ext2fs/closefs.c
|
||||
index 1f99113..ab5b2fb 100644
|
||||
--- a/lib/ext2fs/closefs.c
|
||||
+++ b/lib/ext2fs/closefs.c
|
||||
@@ -287,7 +287,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
|
||||
dgrp_t j;
|
||||
#endif
|
||||
char *group_ptr;
|
||||
- int old_desc_blocks;
|
||||
+ blk64_t old_desc_blocks;
|
||||
struct ext2fs_numeric_progress_struct progress;
|
||||
|
||||
EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
|
||||
@@ -346,7 +346,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
|
||||
group_ptr = (char *) group_shadow;
|
||||
if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
|
||||
old_desc_blocks = fs->super->s_first_meta_bg;
|
||||
- if (old_desc_blocks > fs->super->s_first_meta_bg)
|
||||
+ if (old_desc_blocks > fs->desc_blocks)
|
||||
old_desc_blocks = fs->desc_blocks;
|
||||
} else
|
||||
old_desc_blocks = fs->desc_blocks;
|
||||
--
|
||||
2.1.0
|
||||
|
|
@ -21,6 +21,7 @@ SRC_URI += "file://acinclude.m4 \
|
|||
file://misc-mke2fs.c-return-error-when-failed-to-populate-fs.patch \
|
||||
file://cache_inode.patch \
|
||||
file://CVE-2015-0247.patch \
|
||||
file://0001-libext2fs-fix-potential-buffer-overflow-in-closefs.patch \
|
||||
"
|
||||
|
||||
SRC_URI[md5sum] = "3f8e41e63b432ba114b33f58674563f7"
|
||||
|
|
Loading…
Reference in New Issue