packages/fcgi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!11 [sync] PR-6: Fix CVE-2025-23016

Browse Source 
From: @openeuler-sync-bot 
Reviewed-by: @wk333 
Signed-off-by: @wk333
This commit is contained in:
openeuler-ci-bot 2025-04-27 07:08:56 +00:00 committed by Gitee
commit 2227b2c7e5
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
2 changed files with 45 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
CVE-2025-23016.patch Normal file
View File

@ -0,0 +1,38 @@
From b0eabcaf4d4f371514891a52115c746815c2ff15 Mon Sep 17 00:00:00 2001
From: Pycatchown <39068868+Pycatchown@users.noreply.github.com>
Date: Tue, 8 Apr 2025 17:39:30 +0200
Subject: [PATCH] Update fcgiapp.c
Origin: https://github.com/FastCGI-Archives/fcgi2/commit/b0eabcaf4d4f371514891a52115c746815c2ff15
Fixing an integer overflow (CVE-2025-23016)
---
libfcgi/fcgiapp.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/libfcgi/fcgiapp.c b/libfcgi/fcgiapp.c
index 4ffe318..99c3630 100644
--- a/libfcgi/fcgiapp.c
+++ b/libfcgi/fcgiapp.c
@@ -1175,6 +1175,10 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
}
nameLen = ((nameLen & 0x7f) << 24) + (lenBuff[0] << 16)
+ (lenBuff[1] << 8) + lenBuff[2];
+ if (nameLen >= INT_MAX) {
+ SetError(stream, FCGX_PARAMS_ERROR);
+ return -1;
+ }
}
if((valueLen = FCGX_GetChar(stream)) == EOF) {
SetError(stream, FCGX_PARAMS_ERROR);
@@ -1187,6 +1191,10 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
}
valueLen = ((valueLen & 0x7f) << 24) + (lenBuff[0] << 16)
+ (lenBuff[1] << 8) + lenBuff[2];
+ if (valueLen >= INT_MAX) {
+ SetError(stream, FCGX_PARAMS_ERROR);
+ return -1;
+ }
}
/*
* nameLen and valueLen are now valid; read the name and value

10
fcgi.spec
View File

@ -1,10 +1,11 @@
Name: fcgi
Version: 2.4.2
Release: 1
Release: 2
Summary: FastCGI development kit
License: OML
URL: https://github.com/FastCGI-Archives/fcgi2
Source0: https://github.com/FastCGI-Archives/fcgi2/archive/%{version}.tar.gz
Patch0: CVE-2025-23016.patch
BuildRequires: gcc gcc-c++ sed coreutils libtool
%description
@ -19,7 +20,7 @@ The %{name}-devel package contains libraries and header files for
developing applications that use %{name}.
%prep
%autosetup -n fcgi2-%{version}
%autosetup -n fcgi2-%{version} -p1
sed -i 's/\r//' doc/fastcgi-prog-guide/ch2c.htm
chmod a-x include/fcgios.h libfcgi/os_unix.c LICENSE.TERMS doc/fastcgi-prog-guide/*
@ -57,5 +58,8 @@ rm -rf %{buildroot}%{_libdir}/pkgconfig/fcgi.pc
%doc doc/
%changelog
* Sat Jan 9 2021 chengzihan <chengzihan2@huawei.com> - 2.4.0-1
* Sun Apr 27 2025 wangkai <13474090681@163.com> - 2.4.2-2
- Fix CVE-2025-23016
* Sat Jan 9 2021 chengzihan <chengzihan2@huawei.com> - 2.4.2-1
- Package init