diff options
| author |   Arjun Shankar <arjun@redhat.com> | 2024-01-15 17:44:45 +0100 |
|---|---|---|
| committer |   Andreas K. Hüttel <dilfridge@gentoo.org> | 2024-01-30 19:14:44 +0100 |
| commit | fd6a0404c3245451a264751a5b4b988370215c2a (patch) | |
| tree | e5cf9c7f81986285371a94bd084324821274336c | |
| parent | syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6779) (diff) | |
| download | glibc-fd6a0404c3245451a264751a5b4b988370215c2a.tar.gz glibc-fd6a0404c3245451a264751a5b4b988370215c2a.tar.bz2 glibc-fd6a0404c3245451a264751a5b4b988370215c2a.zip | |
syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)gentoo/glibc-2.38-10
__vsyslog_internal calculated a buffer size by adding two integers, but
did not first check if the addition would overflow. This commit fixes
that.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Tested-by: Carlos O'Donell <carlos@redhat.com>
(cherry picked from commit ddf542da94caf97ff43cc2875c88749880b7259b)
(cherry picked from commit d37c2b20a4787463d192b32041c3406c2bd91de0)
| -rw-r--r-- | misc/syslog.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/misc/syslog.c b/misc/syslog.c index 53440e47ad..4af87f54fd 100644 --- a/misc/syslog.c +++ b/misc/syslog.c @@ -41,6 +41,7 @@ static char sccsid[] = "@(#)syslog.c 8.4 (Berkeley) 3/18/94"; #include <sys/uio.h> #include <sys/un.h> #include <syslog.h> +#include <limits.h> static int LogType = SOCK_DGRAM; /* type of socket connection */ static int LogFile = -1; /* fd for log */ @@ -219,7 +220,7 @@ __vsyslog_internal (int pri, const char *fmt, va_list ap, vl = __vsnprintf_internal (pos, len, fmt, apc, mode_flags); va_end (apc); - if (vl < 0) + if (vl < 0 || vl >= INT_MAX - l) goto out; if (vl >= len) |