diff options
| author |   Florian Weimer <fweimer@redhat.com> | 2024-04-25 15:00:45 +0200 |
|---|---|---|
| committer |   Andreas K. Hüttel <dilfridge@gentoo.org> | 2024-04-26 17:17:06 +1100 |
| commit | dfc8a08f82afcb6a064b3814fd85d32a81e36566 (patch) | |
| tree | 4488235dcac43d1a87fe8fd80ca40b353b40498e | |
| parent | x86: Define MINIMUM_X86_ISA_LEVEL in config.h [BZ #31676] (diff) | |
| download | glibc-dfc8a08f82afcb6a064b3814fd85d32a81e36566.tar.gz glibc-dfc8a08f82afcb6a064b3814fd85d32a81e36566.tar.bz2 glibc-dfc8a08f82afcb6a064b3814fd85d32a81e36566.zip | |
CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bug 31677)
Using alloca matches what other caches do. The request length is
bounded by MAXKEYLEN.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
(cherry picked from commit 87801a8fd06db1d654eea3e4f7626ff476a9bdaa)
(cherry picked from commit 1263d583d2e28afb8be53f8d6922f0842036f35d)
| -rw-r--r-- | nscd/netgroupcache.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c index 0c6e46f15c..f227dc7fa2 100644 --- a/nscd/netgroupcache.c +++ b/nscd/netgroupcache.c @@ -502,12 +502,13 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req, = (struct indataset *) mempool_alloc (db, sizeof (*dataset) + req->key_len, 1); - struct indataset dataset_mem; bool cacheable = true; if (__glibc_unlikely (dataset == NULL)) { cacheable = false; - dataset = &dataset_mem; + /* The alloca is safe because nscd_run_worker verfies that + key_len is not larger than MAXKEYLEN. */ + dataset = alloca (sizeof (*dataset) + req->key_len); } datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len, |