AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-21 12:30:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)

Browse Source 
__vsyslog_internal calculated a buffer size by adding two integers, but
did not first check if the addition would overflow.  This commit fixes
that.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Tested-by: Carlos O'Donell <carlos@redhat.com>
This commit is contained in:
Arjun Shankar 2024-01-15 17:44:45 +01:00
parent 7e5a0c286d
commit ddf542da94
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
misc/syslog.c
View File

@ -41,6 +41,7 @@ static char sccsid[] = "@(#)syslog.c 8.4 (Berkeley) 3/18/94";
#include <sys/uio.h> #include <sys/uio.h>
#include <sys/un.h> #include <sys/un.h>
#include <syslog.h> #include <syslog.h>
#include <limits.h>
static int LogType = SOCK_DGRAM; /* type of socket connection */ static int LogType = SOCK_DGRAM; /* type of socket connection */
static int LogFile = -1; /* fd for log */ static int LogFile = -1; /* fd for log */
@ -219,7 +220,7 @@ __vsyslog_internal (int pri, const char *fmt, va_list ap,
vl = __vsnprintf_internal (pos, len, fmt, apc, mode_flags); vl = __vsnprintf_internal (pos, len, fmt, apc, mode_flags);
va_end (apc); va_end (apc);
if (vl < 0) if (vl < 0 || vl >= INT_MAX - l)
goto out; goto out;
if (vl >= len) if (vl >= len)