--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: stretch
User: release.debian.org@packages.debian.org
Usertags: pu
Hi
this is the respective proposed update for gnulib to address
CVE-2018-17942 / #910757. Technically the bug is not yet fixed in
unstable/buster but pending in the delayed queue.
So you might want to not accept it until the unstable upload really
reaches the archive.
This only fixes the issue in src:gnulib itself, any other project
which is enbedding gnulib has not been checked for the particular
issue (and might be done in future). pspp where the original report
comes from at least contains an updated gnulib copy already in
unstable/buster.
Regards,
Salvatore
diff -Nru gnulib-20140202+stable/debian/changelog gnulib-20140202+stable/debian/changelog
--- gnulib-20140202+stable/debian/changelog 2014-03-03 14:18:15.000000000 +0100
+++ gnulib-20140202+stable/debian/changelog 2019-02-09 21:58:02.000000000 +0100
@@ -1,3 +1,10 @@
+gnulib (20140202+stable-2+deb9u1) stretch; urgency=medium
+
+ * Non-maintainer upload.
+ * vasnprintf: Fix heap memory overrun bug (CVE-2018-17942) (Closes: #910757)
+
+ -- Salvatore Bonaccorso <carnil@debian.org> Sat, 09 Feb 2019 21:58:02 +0100
+
gnulib (20140202+stable-2) unstable; urgency=low
* New package: git-merge-changelog (Closes: #646013).
diff -Nru gnulib-20140202+stable/debian/patches/03-vasnprintf-Fix-heap-memory-overrun-bug.patch gnulib-20140202+stable/debian/patches/03-vasnprintf-Fix-heap-memory-overrun-bug.patch
--- gnulib-20140202+stable/debian/patches/03-vasnprintf-Fix-heap-memory-overrun-bug.patch 1970-01-01 01:00:00.000000000 +0100
+++ gnulib-20140202+stable/debian/patches/03-vasnprintf-Fix-heap-memory-overrun-bug.patch 2019-02-09 21:58:02.000000000 +0100
@@ -0,0 +1,70 @@
+From: Bruno Haible <bruno@clisp.org>
+Date: Sun, 23 Sep 2018 14:13:52 +0200
+Subject: vasnprintf: Fix heap memory overrun bug.
+Origin: https://github.com/coreutils/gnulib/commit/278b4175c9d7dd47c1a3071554aac02add3b3c35
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-17942
+Bug-Debian: https://bugs.debian.org/910757
+Bug: https://lists.gnu.org/archive/html/bug-gnulib/2018-09/msg00107.html
+
+Reported by Ben Pfaff <blp@cs.stanford.edu> in
+<https://lists.gnu.org/archive/html/bug-gnulib/2018-09/msg00107.html>.
+
+* lib/vasnprintf.c (convert_to_decimal): Allocate one more byte of
+memory.
+* tests/test-vasnprintf.c (test_function): Add another test.
+---
+ ChangeLog | 9 +++++++++
+ lib/vasnprintf.c | 4 +++-
+ tests/test-vasnprintf.c | 21 ++++++++++++++++++++-
+ 3 files changed, 32 insertions(+), 2 deletions(-)
+
+diff --git a/lib/vasnprintf.c b/lib/vasnprintf.c
+index 56ffbe308a6a..30d021b2847d 100644
+--- a/lib/vasnprintf.c
++++ b/lib/vasnprintf.c
+@@ -860,7 +860,9 @@ convert_to_decimal (mpn_t a, size_t extra_zeroes)
+ size_t a_len = a.nlimbs;
+ /* 0.03345 is slightly larger than log(2)/(9*log(10)). */
+ size_t c_len = 9 * ((size_t)(a_len * (GMP_LIMB_BITS * 0.03345f)) + 1);
+- char *c_ptr = (char *) malloc (xsum (c_len, extra_zeroes));
++ /* We need extra_zeroes bytes for zeroes, followed by c_len bytes for the
++ digits of a, followed by 1 byte for the terminating NUL. */
++ char *c_ptr = (char *) malloc (xsum (xsum (extra_zeroes, c_len), 1));
+ if (c_ptr != NULL)
+ {
+ char *d_ptr = c_ptr;
+diff --git a/tests/test-vasnprintf.c b/tests/test-vasnprintf.c
+index 19731bc93378..93d81d7041c5 100644
+--- a/tests/test-vasnprintf.c
++++ b/tests/test-vasnprintf.c
+@@ -53,7 +53,26 @@ test_function (char * (*my_asnprintf) (char *, size_t *, const char *, ...))
+ ASSERT (result != NULL);
+ ASSERT (strcmp (result, "12345") == 0);
+ ASSERT (length == 5);
+- if (size < 6)
++ if (size < 5 + 1)
++ ASSERT (result != buf);
++ ASSERT (memcmp (buf + size, &"DEADBEEF"[size], 8 - size) == 0);
++ if (result != buf)
++ free (result);
++ }
++
++ /* Note: This test assumes IEEE 754 representation of 'double' floats. */
++ for (size = 0; size <= 8; size++)
++ {
++ size_t length;
++ char *result;
++
++ memcpy (buf, "DEADBEEF", 8);
++ length = size;
++ result = my_asnprintf (buf, &length, "%2.0f", 1.6314159265358979e+125);
++ ASSERT (result != NULL);
++ ASSERT (strcmp (result, "163141592653589790215729350939528493057529598899734151772468186268423257777068536614838678161083520756952076273094236944990208") == 0);
++ ASSERT (length == 126);
++ if (size < 126 + 1)
+ ASSERT (result != buf);
+ ASSERT (memcmp (buf + size, &"DEADBEEF"[size], 8 - size) == 0);
+ if (result != buf)
+--
+2.20.1
+
diff -Nru gnulib-20140202+stable/debian/patches/series gnulib-20140202+stable/debian/patches/series
--- gnulib-20140202+stable/debian/patches/series 2014-03-03 14:18:15.000000000 +0100
+++ gnulib-20140202+stable/debian/patches/series 2019-02-09 21:58:02.000000000 +0100
@@ -1,2 +1,3 @@
01-gnulib-directory.patch
02-shebang.patch
+03-vasnprintf-Fix-heap-memory-overrun-bug.patch
--- End Message ---