File ld-so-cache-validation.patch of Package glibc.29706

2018-10-24  Andreas Schwab  <schwab@suse.de>

	[BZ #18093]
	* elf/dl-cache.c (_dl_load_cache_lookup): Check for truncated old
	format cache.
	* elf/cache.c (print_cache): Likewise.

Index: glibc-2.22/elf/cache.c
===================================================================
--- glibc-2.22.orig/elf/cache.c
+++ glibc-2.22/elf/cache.c
@@ -193,6 +193,11 @@ print_cache (const char *cache_name)
     }
   else
     {
+      /* Check for corruption, avoiding overflow.  */
+      if ((cache_size - sizeof (struct cache_file)) / sizeof (struct file_entry)
+	  < cache->nlibs)
+	error (EXIT_FAILURE, 0, _("File is not a cache file.\n"));
+
       size_t offset = ALIGN_CACHE (sizeof (struct cache_file)
 				   + (cache->nlibs
 				      * sizeof (struct file_entry)));
Index: glibc-2.22/elf/dl-cache.c
===================================================================
--- glibc-2.22.orig/elf/dl-cache.c
+++ glibc-2.22/elf/dl-cache.c
@@ -205,7 +205,10 @@ _dl_load_cache_lookup (const char *name)
 	 - only the new format
 	 The following checks if the cache contains any of these formats.  */
       if (file != MAP_FAILED && cachesize > sizeof *cache
-	  && memcmp (file, CACHEMAGIC, sizeof CACHEMAGIC - 1) == 0)
+	  && memcmp (file, CACHEMAGIC, sizeof CACHEMAGIC - 1) == 0
+	  /* Check for corruption, avoiding overflow.  */
+	  && ((cachesize - sizeof *cache) / sizeof (struct file_entry)
+	      >= ((struct cache_file *) file)->nlibs))
 	{
 	  size_t offset;
 	  /* Looks ok.  */