From 6bd0e4efcc78f3c0115e5ea9739a1642807450da Mon Sep 17 00:00:00 2001 From: Arjun Shankar Date: Mon, 15 Jan 2024 17:44:43 +0100 Subject: syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246) __vsyslog_internal did not handle a case where printing a SYSLOG_HEADER containing a long program name failed to update the required buffer size, leading to the allocation and overflow of a too-small buffer on the heap. This commit fixes that. It also adds a new regression test that uses glibc.malloc.check. Reviewed-by: Adhemerval Zanella Reviewed-by: Carlos O'Donell Tested-by: Carlos O'Donell --- misc/Makefile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'misc/Makefile') diff --git a/misc/Makefile b/misc/Makefile index 42899c2b6c..c273ec6974 100644 --- a/misc/Makefile +++ b/misc/Makefile @@ -289,7 +289,10 @@ tests-special += $(objpfx)tst-error1-mem.out \ $(objpfx)tst-allocate_once-mem.out endif -tests-container := tst-syslog +tests-container := \ + tst-syslog \ + tst-syslog-long-progname \ + # tests-container CFLAGS-select.c += -fexceptions -fasynchronous-unwind-tables CFLAGS-tsearch.c += $(uses-callbacks) @@ -351,6 +354,9 @@ $(objpfx)tst-allocate_once-mem.out: $(objpfx)tst-allocate_once.out $(common-objpfx)malloc/mtrace $(objpfx)tst-allocate_once.mtrace > $@; \ $(evaluate-test) +tst-syslog-long-progname-ENV = GLIBC_TUNABLES=glibc.malloc.check=3 \ + LD_PRELOAD=libc_malloc_debug.so.0 + $(objpfx)tst-select: $(librt) $(objpfx)tst-select-time64: $(librt) $(objpfx)tst-pselect: $(librt) -- cgit v1.2.3