Fix underallocation of abort_msg_s struct (CVE-2025-0395)
authorFlorian Weimer <fweimer@redhat.com>
Wed, 22 Jan 2025 16:22:02 +0000 (17:22 +0100)
committerSean Whitton <spwhitton@spwhitton.name>
Tue, 27 May 2025 10:40:04 +0000 (11:40 +0100)
commit26ff8f90240200602b6afc10a66f5196e738e076
tree72544ee672931ce5b0a357c5c0f8f4a3e0b204f5
parent8586c3ae9b8730849c3f402bc9170a581c123181
Fix underallocation of abort_msg_s struct (CVE-2025-0395)

Include the space needed to store the length of the message itself, in
addition to the message string.  This resolves BZ #32582.

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
(cherry picked from commit 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578)

Conflict in sysdeps/posix/libc_fatal.c due to missing cleanup after
backtrace removal.

(cherry picked from commit df4e1f4a5096b385c9bcc94424cf2eaa227b3761)

Gbp-Pq: Topic any
Gbp-Pq: Name local-CVE-2025-0395-1.diff
assert/assert.c
sysdeps/posix/libc_fatal.c