diff options
author | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2023-09-19 18:39:32 -0400 |
---|---|---|
committer | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2023-10-02 15:35:29 -0400 |
commit | 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa (patch) | |
tree | 7c97228a74e8790ae0a48a64254bfb977922dff6 /soft-fp/subtf3.c | |
parent | 0d5f9ea97f1b39f2a855756078771673a68497e1 (diff) | |
download | glibc-1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa.zip glibc-1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa.tar.gz glibc-1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa.tar.bz2 |
tunables: Terminate if end of input is reached (CVE-2023-4911)
The string parsing routine may end up writing beyond bounds of tunestr
if the input tunable string is malformed, of the form name=name=val.
This gets processed twice, first as name=name=val and next as name=val,
resulting in tunestr being name=name=val:name=val, thus overflowing
tunestr.
Terminate the parsing loop at the first instance itself so that tunestr
does not overflow.
This also fixes up tst-env-setuid-tunables to actually handle failures
correct and add new tests to validate the fix for this CVE.
Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Diffstat (limited to 'soft-fp/subtf3.c')
0 files changed, 0 insertions, 0 deletions