packages/fcgi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix CVE-2025-23016

Browse Source 
(cherry picked from commit de9f1d1b632815e9292d582fe619682b1dbcce9e)
This commit is contained in:
wk333 2025-04-27 09:32:24 +08:00 committed by openeuler-sync-bot
parent 87ddc57f20
commit 7941891dc3
2 changed files with 45 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
CVE-2025-23016.patch Normal file
View File

@ -0,0 +1,38 @@
From b0eabcaf4d4f371514891a52115c746815c2ff15 Mon Sep 17 00:00:00 2001
From: Pycatchown <39068868+Pycatchown@users.noreply.github.com>
Date: Tue, 8 Apr 2025 17:39:30 +0200
Subject: [PATCH] Update fcgiapp.c
Origin: https://github.com/FastCGI-Archives/fcgi2/commit/b0eabcaf4d4f371514891a52115c746815c2ff15
Fixing an integer overflow (CVE-2025-23016)
---
libfcgi/fcgiapp.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/libfcgi/fcgiapp.c b/libfcgi/fcgiapp.c
index 4ffe318..99c3630 100644
--- a/libfcgi/fcgiapp.c
+++ b/libfcgi/fcgiapp.c
@@ -1175,6 +1175,10 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
}
nameLen = ((nameLen & 0x7f) << 24) + (lenBuff[0] << 16)
+ (lenBuff[1] << 8) + lenBuff[2];
+ if (nameLen >= INT_MAX) {
+ SetError(stream, FCGX_PARAMS_ERROR);
+ return -1;
+ }
}
if((valueLen = FCGX_GetChar(stream)) == EOF) {
SetError(stream, FCGX_PARAMS_ERROR);
@@ -1187,6 +1191,10 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
}
valueLen = ((valueLen & 0x7f) << 24) + (lenBuff[0] << 16)
+ (lenBuff[1] << 8) + lenBuff[2];
+ if (valueLen >= INT_MAX) {
+ SetError(stream, FCGX_PARAMS_ERROR);
+ return -1;
+ }
}
/*
* nameLen and valueLen are now valid; read the name and value

10
fcgi.spec
View File

@ -1,10 +1,11 @@
Name: fcgi
Version: 2.4.2
Release: 1
Release: 2
Summary: FastCGI development kit
License: OML
URL: https://github.com/FastCGI-Archives/fcgi2
Source0: https://github.com/FastCGI-Archives/fcgi2/archive/%{version}.tar.gz
Patch0: CVE-2025-23016.patch
BuildRequires: gcc gcc-c++ sed coreutils libtool
%description
@ -19,7 +20,7 @@ The %{name}-devel package contains libraries and header files for
developing applications that use %{name}.
%prep
%autosetup -n fcgi2-%{version}
%autosetup -n fcgi2-%{version} -p1
sed -i 's/\r//' doc/fastcgi-prog-guide/ch2c.htm
chmod a-x include/fcgios.h libfcgi/os_unix.c LICENSE.TERMS doc/fastcgi-prog-guide/*
@ -57,5 +58,8 @@ rm -rf %{buildroot}%{_libdir}/pkgconfig/fcgi.pc
%doc doc/
%changelog
* Sat Jan 9 2021 chengzihan <chengzihan2@huawei.com> - 2.4.0-1
* Sun Apr 27 2025 wangkai <13474090681@163.com> - 2.4.2-2
- Fix CVE-2025-23016
* Sat Jan 9 2021 chengzihan <chengzihan2@huawei.com> - 2.4.2-1
- Package init