File assert-message-allocation.patch of Package glibc.34926
From df4e1f4a5096b385c9bcc94424cf2eaa227b3761 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Wed, 22 Jan 2025 17:22:02 +0100
Subject: [PATCH] Fix underallocation of abort_msg_s struct (CVE-2025-0395)
Include the space needed to store the length of the message itself, in
addition to the message string. This resolves BZ #32582.
Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed: Adhemerval Zanella <adhemerval.zanella@linaro.org>
(cherry picked from commit 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578)
Conflict in sysdeps/posix/libc_fatal.c due to missing cleanup after
backtrace removal.
---
NEWS | 6 ++++++
assert/assert.c | 4 +++-
sysdeps/posix/libc_fatal.c | 5 +++--
3 files changed, 12 insertions(+), 3 deletions(-)
Index: glibc-2.22/assert/assert.c
===================================================================
--- glibc-2.22.orig/assert/assert.c
+++ glibc-2.22/assert/assert.c
@@ -64,7 +64,8 @@ __assert_fail_base (const char *fmt, con
(void) __fxprintf (NULL, "%s", str);
(void) fflush (stderr);
- total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1);
+ total = ((total + sizeof (struct abort_msg_s) + 1 + GLRO(dl_pagesize) - 1)
+ & ~(GLRO(dl_pagesize) - 1));
struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE,
MAP_ANON | MAP_PRIVATE, -1, 0);
if (__glibc_likely (buf != MAP_FAILED))
Index: glibc-2.22/sysdeps/posix/libc_fatal.c
===================================================================
--- glibc-2.22.orig/sysdeps/posix/libc_fatal.c
+++ glibc-2.22/sysdeps/posix/libc_fatal.c
@@ -142,7 +142,7 @@ __libc_message (int do_abort, const char
if (do_abort)
{
- total = ((total + 1 + GLRO(dl_pagesize) - 1)
+ total = ((total + sizeof (struct abort_msg_s) + 1 + GLRO(dl_pagesize) - 1)
& ~(GLRO(dl_pagesize) - 1));
struct abort_msg_s *buf = __mmap (NULL, total,
PROT_READ | PROT_WRITE,
