The maximum name and file sizes in the "new" header format are 32-bit
unsigned values. However, the I/O functions mostly use long for sizes
and offsets, so that sizes >= 2^31 are handled wrongly on 32-bit
systems.
The current GNU cpio code doesn't seem to have this problem, but the
divergence between this version and that is large enough that I can't
simply cherry-pick a fix for it.
As a short-term fix, in read_in_new_ascii(), fail if c_namesize or
c_filesize is > LONG_MAX.
CVE-2021-31872
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Gbp-Pq: Name 0039-klibc-cpio-Fix-possible-integer-overflow-on-32-bit-s.patch
calloc() multiplies its 2 arguments together and passes the result to
malloc(). Since the factors and product both have type size_t, this
can result in an integer overflow and subsequent buffer overflow.
Check for this and fail if it happens.
CVE-2021-31870
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Gbp-Pq: Name 0037-klibc-calloc-Fail-if-multiplication-overflows.patch
malloc() adds some overhead to the requested size, which may result in
an integer overflow and subsequent buffer overflow if it is close to
SIZE_MAX. It should fail if size is large enough for this to happen.
Further, it's not legal for a C object to be larger than
PTRDIFF_MAX (half of SIZE_MAX) as pointer arithmetic within it could
overflow. So return failure immediately if size is greater than that.
CVE-2021-31873
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Gbp-Pq: Name 0036-klibc-malloc-Fail-if-requested-size-PTRDIFF_MAX.patch
sparc allows specifiying a signal restorer in the usual way. We
should do this to avoid needing an executable stack.
* Define a __sigreturn() routine that calls rt_sigreturn
* Force the SA_RESTORER flag on for all signal handlers, and set
__sigreturn as the restorer if none is already set
* Force the SA_SIGINFO flag on for all signal handlers, so that we can
always return from them with rt_sigreturn
* Set KLIBCEXECSTACK=n
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Gbp-Pq: Name 0005-klibc-sparc-Set-sa_restorer-for-signals-and-disable-.patch
alpha does not support the SA_RESTORER flag, but allows specifiying a
restorer callback as an additional parameter to rt_sigaction(). We
should do this to avoid needing an executable stack.
* Force the SA_SIGINFO flag on for all signal handlers, so that we can
always return from them with rt_sigreturn
* Define a __sigreturn() routine that calls rt_sigreturn
* Pass that routine as the last argument to rt_sigaction()
* Set KLIBCEXECSTACK=n
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Gbp-Pq: Name 0004-klibc-alpha-Pass-restorer-to-rt_sigaction-and-disabl.patch
s390 allows specifiying a signal restorer in the usual way. We
should do this to avoid needing an executable stack.
* Define a __sigreturn() routine that calls rt_sigreturn
* Force the SA_RESTORER flag on for all signal handlers, and set
__sigreturn as the restorer if none is already set
* Force the SA_SIGINFO flag on for all signal handlers, so that we can
always return from them with rt_sigreturn
* Set KLIBCEXECSTACK=n
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Gbp-Pq: Name 0003-klibc-s390-Set-sa_restorer-for-signals-and-disable-e.patch
On alpha, arm, i386, m68k, powerpc, s390, sh, and sparc (32-bit), the
kernel sets up the signal stack frame differently depending on the
SA_SIGINFO flag, not whether the sigaction() or rt_sigaction() system
call was used to install the handler.
On alpha and sparc, we are going to start providing our own restorer
that will call rt_sigaction(), so will need to ensure this flag is
always set.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Gbp-Pq: Name 0002-klibc-signal-Add-sysconfig-setting-to-force-SA_SIGIN.patch
projects / klibc.git / log