Fix underallocation of abort_msg_s struct (CVE-2025-0395)
authorFlorian Weimer <fweimer@redhat.com>
Wed, 22 Jan 2025 16:22:02 +0000 (17:22 +0100)
committerSean Whitton <spwhitton@spwhitton.name>
Wed, 30 Apr 2025 01:01:35 +0000 (09:01 +0800)
commit2abfda367ff7edec76c40306b772c5ddc62a5968
tree1a47866a01e61225c3d312bf9e91511a90d31123
parent92a356fdb5f21daa59ccee6e8309b97550a7c91b
Fix underallocation of abort_msg_s struct (CVE-2025-0395)

Include the space needed to store the length of the message itself, in
addition to the message string.  This resolves BZ #32582.

Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
(cherry picked from commit 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578)

Conflict in sysdeps/posix/libc_fatal.c due to missing cleanup after
backtrace removal.

(cherry picked from commit df4e1f4a5096b385c9bcc94424cf2eaa227b3761)

Gbp-Pq: Topic any
Gbp-Pq: Name local-CVE-2025-0395-1.diff
assert/assert.c
sysdeps/posix/libc_fatal.c