aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChen Qi <Qi.Chen@windriver.com>2018-09-26 10:36:25 +0800
committerBruce Ashfield <bruce.ashfield@windriver.com>2018-09-30 21:34:09 -0400
commit69f0c7cf74a9af4c5a0a3ead2d608dd155e159ce (patch)
tree9044cae684c80378164790beb56ba791f3ef7948
parent5793d336ae63744d573821aba2f2b22000aae0c1 (diff)
downloadmeta-cloud-services-69f0c7cf74a9af4c5a0a3ead2d608dd155e159ce.tar.gz
meta-cloud-services-69f0c7cf74a9af4c5a0a3ead2d608dd155e159ce.tar.bz2
meta-cloud-services-69f0c7cf74a9af4c5a0a3ead2d608dd155e159ce.zip
glusterfs: fix CVE-2018-10911
Backport patch to fix the following CVE. CVE: CVE-2018-10911 Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
-rw-r--r--recipes-extended/glusterfs/files/0001-dict-handle-negative-key-value-length-while-unserial.patch39
-rw-r--r--recipes-extended/glusterfs/glusterfs.inc1
2 files changed, 40 insertions, 0 deletions
diff --git a/recipes-extended/glusterfs/files/0001-dict-handle-negative-key-value-length-while-unserial.patch b/recipes-extended/glusterfs/files/0001-dict-handle-negative-key-value-length-while-unserial.patch
new file mode 100644
index 0000000..cb3400b
--- /dev/null
+++ b/recipes-extended/glusterfs/files/0001-dict-handle-negative-key-value-length-while-unserial.patch
@@ -0,0 +1,39 @@
+From 428ee988df7d6cbe6e18becffcee5cdfb0fa9d17 Mon Sep 17 00:00:00 2001
+From: Amar Tumballi <amarts@redhat.com>
+Date: Tue, 24 Jul 2018 13:25:12 +0530
+Subject: [PATCH 1/7] dict: handle negative key/value length while unserialize
+
+Fixes: bz#1625089
+Change-Id: Ie56df0da46c242846a1ba51ccb9e011af118b119
+Signed-off-by: Amar Tumballi <amarts@redhat.com>
+
+Upstream-Status: Backport
+
+Fix CVE-2018-10911
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ libglusterfs/src/dict.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/libglusterfs/src/dict.c b/libglusterfs/src/dict.c
+index 839b426..ac0a677 100644
+--- a/libglusterfs/src/dict.c
++++ b/libglusterfs/src/dict.c
+@@ -2751,6 +2751,13 @@ dict_unserialize (char *orig_buf, int32_t size, dict_t **fill)
+ vallen = ntoh32 (hostord);
+ buf += DICT_DATA_HDR_VAL_LEN;
+
++ if ((keylen < 0) || (vallen < 0)) {
++ gf_msg_callingfn ("dict", GF_LOG_ERROR, 0,
++ LG_MSG_UNDERSIZED_BUF,
++ "undersized length passed "
++ "key:%d val:%d", keylen, vallen);
++ goto out;
++ }
+ if ((buf + keylen) > (orig_buf + size)) {
+ gf_msg_callingfn ("dict", GF_LOG_ERROR, 0,
+ LG_MSG_UNDERSIZED_BUF,
+--
+2.7.4
+
diff --git a/recipes-extended/glusterfs/glusterfs.inc b/recipes-extended/glusterfs/glusterfs.inc
index ab63a9a..ea5f2b7 100644
--- a/recipes-extended/glusterfs/glusterfs.inc
+++ b/recipes-extended/glusterfs/glusterfs.inc
@@ -23,6 +23,7 @@ SRC_URI += "file://glusterd.init \
file://0001-shared-storage-Prevent-mounting-shared-storage-from-.patch \
file://0002-server-auth-add-option-for-strict-authentication.patch \
file://0003-glusterfs-access-trusted-peer-group-via-remote-host-.patch \
+ file://0001-dict-handle-negative-key-value-length-while-unserial.patch \
"
LICENSE = "(LGPLv3+ | GPLv2) & GPLv3+ & LGPLv3+ & GPLv2+ & LGPLv2+ & LGPLv2.1+ & Apache-2.0"