<div dir="ltr">This needs rebasing to master, and I suspect your email servers are corrupting your mails as I often have to go and fix up your patches which have had long lines wrapped:<div><br></div><div><div>Applying: glibc:CVE-2017-17426</div><div>error: corrupt patch at line 64</div></div><div><br></div><div>Ross</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 17 January 2018 at 02:46, Huang, Qiyu <span dir="ltr"><<a href="mailto:huangqy.fnst@cn.fujitsu.com" target="_blank">huangqy.fnst@cn.fujitsu.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">ping<br>
<div><div class="h5"><br>
<br>
> -----Original Message-----<br>
> From: Huang, Qiyu<br>
> Sent: Wednesday, December 20, 2017 4:11 PM<br>
> To: <a href="mailto:openembedded-core@lists.openembedded.org">openembedded-core@lists.<wbr>openembedded.org</a><br>
> Cc: Huang, Qiyu <<a href="mailto:huangqy.fnst@cn.fujitsu.com">huangqy.fnst@cn.fujitsu.com</a>><br>
> Subject: [OE-core][PATCH] glibc:CVE-2017-17426<br>
><br>
> Fix the CVE-2017-17426.<br>
><br>
> Signed-off-by: Huang Qiyu <<a href="mailto:huangqy.fnst@cn.fujitsu.com">huangqy.fnst@cn.fujitsu.com</a>><br>
> ---<br>
> ...-overflow-in-malloc-when-<wbr>tcache-is-enable.patch | 52<br>
> ++++++++++++++++++++++<br>
> meta/recipes-core/glibc/<a href="http://glibc_2.26.bb" rel="noreferrer" target="_blank">glibc_<wbr>2.26.bb</a> | 1 +<br>
> 2 files changed, 53 insertions(+)<br>
> create mode 100644<br>
> meta/recipes-core/glibc/glibc/<wbr>0029-Fix-integer-overflow-in-<wbr>malloc-when-tcache<br>
> -is-enable.patch<br>
><br>
> diff --git<br>
> a/meta/recipes-core/glibc/<wbr>glibc/0029-Fix-integer-<wbr>overflow-in-malloc-when-tcac<br>
> he-is-enable.patch<br>
> b/meta/recipes-core/glibc/<wbr>glibc/0029-Fix-integer-<wbr>overflow-in-malloc-when-tcac<br>
> he-is-enable.patch<br>
> new file mode 100644<br>
> index 0000000..623bed7<br>
> --- /dev/null<br>
> +++ b/meta/recipes-core/glibc/<wbr>glibc/0029-Fix-integer-<wbr>overflow-in-malloc-<br>
</div></div>> +++ when-tcache-is-enable.patch<br>
<span class="">> @@ -0,0 +1,52 @@<br>
> +From 34697694e8a93b325b18f25f7dcded<wbr>55d6baeaf6 Mon Sep 17 00:00:00<br>
> 2001<br>
> +From: Arjun Shankar <<a href="mailto:arjun@redhat.com">arjun@redhat.com</a>><br>
> +Date: Thu, 30 Nov 2017 13:31:45 +0100<br>
> +Subject: [PATCH] Fix integer overflow in malloc when tcache is enabled<br>
</span>> +[BZ #22375]<br>
<span class="">> +<br>
> +When the per-thread cache is enabled, __libc_malloc uses request2size<br>
</span>> +(which does not perform an overflow check) to calculate the chunk size<br>
> +from the requested allocation size. This leads to an integer overflow<br>
> +causing malloc to incorrectly return the last successfully allocated<br>
> +block when called with a very large size argument (close to SIZE_MAX).<br>
<span class="">> +<br>
> +This commit uses checked_request2size instead, removing the overflow.<br>
> +<br>
> +Upstream-status: Backport<br>
> +---<br>
> + ChangeLog | 6 ++++++<br>
> + malloc/malloc.c | 3 ++-<br>
> + 2 files changed, 8 insertions(+), 1 deletion(-)<br>
> +<br>
> +diff --git a/ChangeLog b/ChangeLog<br>
> +index b55ed22..888f9fb 100644<br>
> +--- a/ChangeLog<br>
> ++++ b/ChangeLog<br>
> +@@ -1,3 +1,9 @@<br>
> ++2017-11-30 Arjun Shankar <<a href="mailto:arjun@redhat.com">arjun@redhat.com</a>><br>
> ++<br>
> ++ [BZ #22375]<br>
> ++ * malloc/malloc.c (__libc_malloc): Use checked_request2size<br>
> ++ instead of request2size.<br>
> ++<br>
> + 2017-08-02 Siddhesh Poyarekar <<a href="mailto:siddhesh@sourceware.org">siddhesh@sourceware.org</a>><br>
> +<br>
> + * sysdeps/sparc/sparc32/sparcv9/<wbr>fpu/multiarch/s_llrint.S<br>
</span>> +diff --git a/malloc/malloc.c b/malloc/malloc.c index 79f0e9e..0c9e074<br>
> +100644<br>
<span class="">> +--- a/malloc/malloc.c<br>
> ++++ b/malloc/malloc.c<br>
> +@@ -3050,7 +3050,8 @@ __libc_malloc (size_t bytes)<br>
</span>> + return (*hook)(bytes, RETURN_ADDRESS (0)); #if USE_TCACHE<br>
<span class="">> + /* int_free also calls request2size, be careful to not pad twice.<br>
</span>> +*/<br>
<span class="">> +- size_t tbytes = request2size (bytes);<br>
> ++ size_t tbytes;<br>
> ++ checked_request2size (bytes, tbytes);<br>
> + size_t tc_idx = csize2tidx (tbytes);<br>
> +<br>
> + MAYBE_INIT_TCACHE ();<br>
> +--<br>
> +2.7.4<br>
> +<br>
> diff --git a/meta/recipes-core/glibc/<a href="http://glibc_2.26.bb" rel="noreferrer" target="_blank">glib<wbr>c_2.26.bb</a><br>
> b/meta/recipes-core/glibc/<a href="http://glibc_2.26.bb" rel="noreferrer" target="_blank">glib<wbr>c_2.26.bb</a><br>
> index 135ec4f..36b2004 100644<br>
> --- a/meta/recipes-core/glibc/<a href="http://glibc_2.26.bb" rel="noreferrer" target="_blank">glib<wbr>c_2.26.bb</a><br>
> +++ b/meta/recipes-core/glibc/<a href="http://glibc_2.26.bb" rel="noreferrer" target="_blank">glib<wbr>c_2.26.bb</a><br>
> @@ -43,6 +43,7 @@ SRC_URI =<br>
> "${GLIBC_GIT_URI};branch=${<wbr>SRCBRANCH};name=glibc \<br>
><br>
> file://0026-assert-Suppress-<wbr>pedantic-warning-caused-by-<wbr>statement.patch \<br>
> file://0027-glibc-reset-dl-<wbr>load-write-lock-after-forking.<wbr>patch \<br>
> file://0028-Bug-4578-add-ld.<wbr>so-lock-while-fork.patch \<br>
> +<br>
</span>> + file://0029-Fix-integer-<wbr>overflow-in-malloc-when-<wbr>tcache-is-enable.patch<br>
> + \<br>
<div class="HOEnZb"><div class="h5">> "<br>
><br>
> NATIVESDKFIXES ?= ""<br>
> --<br>
> 2.7.4<br>
<br>
<br>
<br>
--<br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
</div></div></blockquote></div><br></div>