Fix underallocation of abort_msg_s struct (CVE-2025-0395)
authorFlorian Weimer <fweimer@redhat.com>
Wed, 22 Jan 2025 16:22:02 +0000 (17:22 +0100)
committerArnaud Rebillout <arnaudr@debian.org>
Wed, 27 May 2026 04:49:44 +0000 (11:49 +0700)
commit04cdfa7acac94e8ea334cd6ce1c7874a9491d389
tree2d1c45f846f62a57d052278edefea3f414df730a
parent6d178f5bf3911684dc3c1896e7d3fd5af85e7fc8
Fix underallocation of abort_msg_s struct (CVE-2025-0395)

Include the space needed to store the length of the message itself, in
addition to the message string.  This resolves BZ #32582.

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
(cherry picked from commit 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578)

Conflict in sysdeps/posix/libc_fatal.c due to missing cleanup after
backtrace removal.

(cherry picked from commit df4e1f4a5096b385c9bcc94424cf2eaa227b3761)

Gbp-Pq: Topic any
Gbp-Pq: Name local-CVE-2025-0395-1.diff
assert/assert.c
sysdeps/posix/libc_fatal.c