debian/changelog

+glibc (2.37-15) unstable; urgency=critical
+
+  * debian/patches/git-updates.diff: update from upstream stable branch:
+    - Fix a heap buffer overflow in __vsyslog_internal (CVE-2023-6246).
+    - Fix an off-by-one heap buffer overflow in __vsyslog_internal
+      (CVE-2023-6779).
+    - Fix an integer overflow in __vsyslog_internal (CVE-2023-6780).
+  * debian/patches/any/local-qsort-memory-corruption.patch: Fix a memory
+    corruption in qsort() when using nontransitive comparison functions.
+  * Set urgency to critical given the security issues.
+
+ -- Aurelien Jarno <aurel32@debian.org>  Tue, 30 Jan 2024 19:20:04 +0100
+
 glibc (2.37-14) unstable; urgency=medium
   [ Aurelien Jarno ]

debian/patches/any/local-qsort-memory-corruption.patch

+diff -rup a/stdlib/qsort.c b/stdlib/qsort.c
+--- a/stdlib/qsort.c	2023-07-31 10:54:16.000000000 -0700
++++ b/stdlib/qsort.c	2024-01-15 09:08:25.596167959 -0800
+@@ -224,7 +224,8 @@ _quicksort (void *const pbase, size_t to
+     while ((run_ptr += size) <= end_ptr)
+       {
+ 	tmp_ptr = run_ptr - size;
+-	while ((*cmp) ((void *) run_ptr, (void *) tmp_ptr, arg) < 0)
++	while (tmp_ptr != base_ptr
++	       && (*cmp) ((void *) run_ptr, (void *) tmp_ptr, arg) < 0)
+ 	  tmp_ptr -= size;
+ 
+ 	tmp_ptr += size;

debian/patches/git-updates.diff

@@ -1523,6 +1523,32 @@ index fd8b52bfac..67df9f8c51 100644
    /* its size */
    const INTERNAL_SIZE_T oldsize = chunksize (oldp);
  
+diff --git a/misc/Makefile b/misc/Makefile
+index 1a09f777fa..5db6f28719 100644
+--- a/misc/Makefile
++++ b/misc/Makefile
+@@ -115,7 +115,10 @@ tests-special += $(objpfx)tst-error1-mem.out \
+   $(objpfx)tst-allocate_once-mem.out
+ endif
+ 
+-tests-container := tst-syslog
++tests-container := \
++  tst-syslog \
++  tst-syslog-long-progname \
++  # tests-container
+ 
+ CFLAGS-select.c += -fexceptions -fasynchronous-unwind-tables
+ CFLAGS-tsearch.c += $(uses-callbacks)
+@@ -177,6 +180,9 @@ $(objpfx)tst-allocate_once-mem.out: $(objpfx)tst-allocate_once.out
+ 	$(common-objpfx)malloc/mtrace $(objpfx)tst-allocate_once.mtrace > $@; \
+ 	$(evaluate-test)
+ 
++tst-syslog-long-progname-ENV = GLIBC_TUNABLES=glibc.malloc.check=3 \
++			       LD_PRELOAD=libc_malloc_debug.so.0
++
+ $(objpfx)tst-select: $(librt)
+ $(objpfx)tst-select-time64: $(librt)
+ $(objpfx)tst-pselect: $(librt)
 diff --git a/misc/sys/cdefs.h b/misc/sys/cdefs.h
 index 66d6702123..c37a3ff637 100644
 --- a/misc/sys/cdefs.h
@@ -1554,6 +1580,193 @@ index 66d6702123..c37a3ff637 100644
  
  #if __GNUC_PREREQ (4,3)
  # define __warnattr(msg) __attribute__((__warning__ (msg)))
+diff --git a/misc/syslog.c b/misc/syslog.c
+index f67d4b58a4..9336036666 100644
+--- a/misc/syslog.c
++++ b/misc/syslog.c
+@@ -41,6 +41,7 @@ static char sccsid[] = "@(#)syslog.c	8.4 (Berkeley) 3/18/94";
+ #include <sys/uio.h>
+ #include <sys/un.h>
+ #include <syslog.h>
++#include <limits.h>
+ 
+ static int LogType = SOCK_DGRAM;	/* type of socket connection */
+ static int LogFile = -1;		/* fd for log */
+@@ -122,8 +123,9 @@ __vsyslog_internal (int pri, const char *fmt, va_list ap,
+ {
+   /* Try to use a static buffer as an optimization.  */
+   char bufs[1024];
+-  char *buf = NULL;
+-  size_t bufsize = 0;
++  char *buf = bufs;
++  size_t bufsize;
++
+   int msgoff;
+   int saved_errno = errno;
+ 
+@@ -175,29 +177,55 @@ __vsyslog_internal (int pri, const char *fmt, va_list ap,
+ #define SYSLOG_HEADER_WITHOUT_TS(__pri, __msgoff)        \
+   "<%d>: %n", __pri, __msgoff
+ 
+-  int l;
++  int l, vl;
+   if (has_ts)
+     l = __snprintf (bufs, sizeof bufs,
+ 		    SYSLOG_HEADER (pri, timestamp, &msgoff, pid));
+   else
+     l = __snprintf (bufs, sizeof bufs,
+ 		    SYSLOG_HEADER_WITHOUT_TS (pri, &msgoff));
+-  if (0 <= l && l < sizeof bufs)
++  if (l < 0)
++    goto out;
++
++  char *pos;
++  size_t len;
++
++  if (l < sizeof bufs)
+     {
+-      va_list apc;
+-      va_copy (apc, ap);
++      /* At this point, there is still a chance that we can print the
++         remaining part of the log into bufs and use that.  */
++      pos = bufs + l;
++      len = sizeof (bufs) - l;
++    }
++  else
++    {
++      buf = NULL;
++      /* We already know that bufs is too small to use for this log message.
++         The next vsnprintf into bufs is used only to calculate the total
++         required buffer length.  We will discard bufs contents and allocate
++         an appropriately sized buffer later instead.  */
++      pos = bufs;
++      len = sizeof (bufs);
++    }
+ 
+-      /* Restore errno for %m format.  */
+-      __set_errno (saved_errno);
++  {
++    va_list apc;
++    va_copy (apc, ap);
+ 
+-      int vl = __vsnprintf_internal (bufs + l, sizeof bufs - l, fmt, apc,
+-                                     mode_flags);
+-      if (0 <= vl && vl < sizeof bufs - l)
+-        buf = bufs;
+-      bufsize = l + vl;
++    /* Restore errno for %m format.  */
++    __set_errno (saved_errno);
+ 
+-      va_end (apc);
+-    }
++    vl = __vsnprintf_internal (pos, len, fmt, apc, mode_flags);
++    va_end (apc);
++
++    if (vl < 0 || vl >= INT_MAX - l)
++      goto out;
++
++    if (vl >= len)
++      buf = NULL;
++
++    bufsize = l + vl;
++  }
+ 
+   if (buf == NULL)
+     {
+@@ -207,25 +235,37 @@ __vsyslog_internal (int pri, const char *fmt, va_list ap,
+ 	  /* Tell the cancellation handler to free this buffer.  */
+ 	  clarg.buf = buf;
+ 
++	  int cl;
+ 	  if (has_ts)
+-	    __snprintf (buf, l + 1,
+-			SYSLOG_HEADER (pri, timestamp, &msgoff, pid));
++	    cl = __snprintf (buf, l + 1,
++			     SYSLOG_HEADER (pri, timestamp, &msgoff, pid));
+ 	  else
+-	    __snprintf (buf, l + 1,
+-			SYSLOG_HEADER_WITHOUT_TS (pri, &msgoff));
++	    cl = __snprintf (buf, l + 1,
++			     SYSLOG_HEADER_WITHOUT_TS (pri, &msgoff));
++	  if (cl != l)
++	    goto out;
+ 
+ 	  va_list apc;
+ 	  va_copy (apc, ap);
+-	  __vsnprintf_internal (buf + l, bufsize - l + 1, fmt, apc,
+-				mode_flags);
++	  cl = __vsnprintf_internal (buf + l, bufsize - l + 1, fmt, apc,
++				     mode_flags);
+ 	  va_end (apc);
++
++	  if (cl != vl)
++	    goto out;
+ 	}
+       else
+         {
++          int bl;
+ 	  /* Nothing much to do but emit an error message.  */
+-          bufsize = __snprintf (bufs, sizeof bufs,
+-                                "out of memory[%d]", __getpid ());
++          bl = __snprintf (bufs, sizeof bufs,
++                           "out of memory[%d]", __getpid ());
++          if (bl < 0 || bl >= sizeof bufs)
++            goto out;
++
++          bufsize = bl;
+           buf = bufs;
++          msgoff = 0;
+         }
+     }
+ 
+diff --git a/misc/tst-syslog-long-progname.c b/misc/tst-syslog-long-progname.c
+new file mode 100644
+index 0000000000..88f37a8a00
+--- /dev/null
++++ b/misc/tst-syslog-long-progname.c
+@@ -0,0 +1,39 @@
++/* Test heap buffer overflow in syslog with long __progname (CVE-2023-6246)
++   Copyright (C) 2023 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <syslog.h>
++#include <string.h>
++
++extern char * __progname;
++
++static int
++do_test (void)
++{
++  char long_progname[2048];
++
++  memset (long_progname, 'X', sizeof (long_progname) - 1);
++  long_progname[sizeof (long_progname) - 1] = '\0';
++
++  __progname = long_progname;
++
++  syslog (LOG_INFO, "Hello, World!");
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/misc/tst-syslog-long-progname.root/postclean.req b/misc/tst-syslog-long-progname.root/postclean.req
+new file mode 100644
+index 0000000000..e69de29bb2
 diff --git a/nss/Makefile b/nss/Makefile
 index 3a9ea065ac..6ef5bf23b3 100644
 --- a/nss/Makefile
@@ -2277,6 +2490,25 @@ index 634acfe264..47a0afe6bf 100644
    TEST_COMPARE (system (""), 0);
  
    return 0;
+diff --git a/sunrpc/netname.c b/sunrpc/netname.c
+index dd2cb1b441..6641d25625 100644
+--- a/sunrpc/netname.c
++++ b/sunrpc/netname.c
+@@ -52,10 +52,14 @@ user2netname (char netname[MAXNETNAMELEN + 1], const uid_t uid,
+   /* GCC with -Os or -O1 warns that sprint might overflow while handling
+      dfltdom, however the above test does check if an overflow would
+      happen.  */
++#if __GNUC_PREREQ (8, 0)
+   DIAG_PUSH_NEEDS_COMMENT;
+   DIAG_IGNORE_NEEDS_COMMENT (8, "-Wformat-overflow");
++#endif
+   sprintf (netname, "%s.%d@%s", OPSYS, uid, dfltdom);
++#if __GNUC_PREREQ (8, 0)
+   DIAG_POP_NEEDS_COMMENT;
++#endif
+   i = strlen (netname);
+   if (netname[i - 1] == '.')
+     netname[i - 1] = '\0';
 diff --git a/support/Makefile b/support/Makefile
 index b29b7eb505..48cd74581d 100644
 --- a/support/Makefile

debian/patches/series

@@ -103,3 +103,4 @@ any/local-cudacc-float128.diff
 any/local-test-install.diff
 any/local-cross.patch
 any/git-c-utf-8-language.diff
+any/local-qsort-memory-corruption.patch