[Astlinux-commits] SF.net SVN: astlinux:[6985] branches/1.0/package/e2fsprogs/ e2fsprogs-CVE-2015-1572.patch

[<abe...@us...>]

Revision: 6985
          http://sourceforge.net/p/astlinux/code/6985
Author:   abelbeck
Date:     2015-02-23 21:40:25 +0000 (Mon, 23 Feb 2015)
Log Message:
-----------
e2fsprogs, security fix: CVE-2015-1572, fix potential buffer overflow in closefs()

Added Paths:
-----------
    branches/1.0/package/e2fsprogs/e2fsprogs-CVE-2015-1572.patch

Added: branches/1.0/package/e2fsprogs/e2fsprogs-CVE-2015-1572.patch
===================================================================
--- branches/1.0/package/e2fsprogs/e2fsprogs-CVE-2015-1572.patch	                        (rev 0)
+++ branches/1.0/package/e2fsprogs/e2fsprogs-CVE-2015-1572.patch	2015-02-23 21:40:25 UTC (rev 6985)
@@ -0,0 +1,58 @@
+From 49d0fe2a14f2a23da2fe299643379b8c1d37df73 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <ty...@mi...>
+Date: Fri, 6 Feb 2015 12:46:39 -0500
+Subject: [PATCH] libext2fs: fix potential buffer overflow in closefs()
+
+Upstream commit 49d0fe2a14f2.
+
+The bug fix in f66e6ce4446: "libext2fs: avoid buffer overflow if
+s_first_meta_bg is too big" had a typo in the fix for
+ext2fs_closefs().  In practice most of the security exposure was from
+the openfs path, since this meant if there was a carefully crafted
+file system, buffer overrun would be triggered when the file system was
+opened.
+
+However, if corrupted file system didn't trip over some corruption
+check, and then the file system was modified via tune2fs or debugfs,
+such that the superblock was marked dirty and then written out via the
+closefs() path, it's possible that the buffer overrun could be
+triggered when the file system is closed.
+
+Also clear up a signed vs unsigned warning while we're at it.
+
+Thanks to Nick Kralevich <nn...@go...> for asking me to look at
+compiler warning in the code in question, which led me to notice the
+bug in f66e6ce4446.
+
+Addresses: CVE-2015-1572
+
+Signed-off-by: Theodore Ts'o <ty...@mi...>
+Signed-off-by: Baruch Siach <ba...@tk...>
+---
+ lib/ext2fs/closefs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/ext2fs/closefs.c b/lib/ext2fs/closefs.c
+index 1f9911311a1a..ab5b2fb2365e 100644
+--- a/lib/ext2fs/closefs.c
++++ b/lib/ext2fs/closefs.c
+@@ -287,7 +287,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
+ 	dgrp_t		j;
+ #endif
+ 	char	*group_ptr;
+-	int	old_desc_blocks;
++	blk64_t	old_desc_blocks;
+ 	struct ext2fs_numeric_progress_struct progress;
+ 
+ 	EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
+@@ -346,7 +346,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
+ 	group_ptr = (char *) group_shadow;
+ 	if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
+ 		old_desc_blocks = fs->super->s_first_meta_bg;
+-		if (old_desc_blocks > fs->super->s_first_meta_bg)
++		if (old_desc_blocks > fs->desc_blocks)
+ 			old_desc_blocks = fs->desc_blocks;
+ 	} else
+ 		old_desc_blocks = fs->desc_blocks;
+-- 
+2.1.4

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.