diff --git a/CVE-2023-39976.patch b/CVE-2023-39976.patch deleted file mode 100644 index 5c5fd35..0000000 --- a/CVE-2023-39976.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 1bbaa929b77113532785c408dd1b41cd0521ffc8 Mon Sep 17 00:00:00 2001 -From: Chrissie Caulfield -Date: Thu, 20 Jul 2023 07:19:01 +0100 -Subject: [PATCH] log: fix potential overflow with long log messages (#490) - -qb_vsnprintf_serialize was called with 'max_size' as the -limiting number for the length of the formatted log -message. But the buffer also needs to contain the -log header (given by 'actual_size'), so we now pass -'t->max_line_length' as the maximum length of the -formatted log message to limit space to the actual -bytes left - -Also added error checks to the blackbox calls at -the end of the test, as these now provide a proper -test that the BB is functioning. Before they were -masking failures. ---- - lib/log_blackbox.c | 4 ++-- - tests/check_log.c | 6 ++++-- - 2 files changed, 6 insertions(+), 4 deletions(-) - -diff --git a/lib/log_blackbox.c b/lib/log_blackbox.c -index 3e30504..8519a48 100644 ---- a/lib/log_blackbox.c -+++ b/lib/log_blackbox.c -@@ -110,8 +110,8 @@ _blackbox_vlogger(int32_t target, - chunk += sizeof(uint32_t); - - /* log message */ -- msg_len = qb_vsnprintf_serialize(chunk, max_size, cs->format, ap); -- if (msg_len >= max_size) { -+ msg_len = qb_vsnprintf_serialize(chunk, t->max_line_length, cs->format, ap); -+ if (msg_len >= t->max_line_length) { - chunk = msg_len_pt + sizeof(uint32_t); /* Reset */ - - /* Leave this at QB_LOG_MAX_LEN so as not to overflow the blackbox */ -diff --git a/tests/check_log.c b/tests/check_log.c -index 039a4bb..e5abf40 100644 ---- a/tests/check_log.c -+++ b/tests/check_log.c -@@ -832,8 +832,10 @@ START_TEST(test_log_long_msg) - qb_log(LOG_INFO, "Message %d %d - %s", lpc, lpc%600, buffer); - } - -- qb_log_blackbox_write_to_file("blackbox.dump"); -- qb_log_blackbox_print_from_file("blackbox.dump"); -+ rc = qb_log_blackbox_write_to_file("blackbox.dump"); -+ ck_assert_int_gt(rc, 0); -+ rc = qb_log_blackbox_print_from_file("blackbox.dump"); -+ ck_assert_int_le(rc, 0); - unlink("blackbox.dump"); - qb_log_fini(); - } --- -2.33.0 - diff --git a/connretry-recv.patch b/connretry-recv.patch deleted file mode 100644 index 5871d38..0000000 --- a/connretry-recv.patch +++ /dev/null @@ -1,46 +0,0 @@ -commit 5594d377ac73d37c06bbad1798e87a65f9a12e07 -Author: Chrissie Caulfield -Date: Fri Nov 25 07:38:20 2022 +0000 - - ipc: Retry receiving credentials if the the message is short (#476) - - ipc: Retry receiving credentials if the the message is short - - rhbz#2111711 refers - -diff --git a/lib/ipc_setup.c b/lib/ipc_setup.c -index 0ef9bb6..0de7115 100644 ---- a/lib/ipc_setup.c -+++ b/lib/ipc_setup.c -@@ -473,11 +473,15 @@ qb_ipcc_us_setup_connect(struct qb_ipcc_connection *c, - return 0; - } - -+#define AUTH_RECV_MAX_RETRIES 10 -+#define AUTH_RECV_SLEEP_TIME_US 100 -+ - /* Called from ipcc_connect_continue() when async connect socket is active */ - int qb_ipcc_setup_connect_continue(struct qb_ipcc_connection *c, struct qb_ipc_connection_response *r) - { - struct ipc_auth_data *data; - int32_t res; -+ int retry_count = 0; - #ifdef QB_LINUX - int off = 0; - #endif -@@ -486,8 +490,14 @@ int qb_ipcc_setup_connect_continue(struct qb_ipcc_connection *c, struct qb_ipc_c - qb_ipcc_us_sock_close(c->setup.u.us.sock); - return -ENOMEM; - } -- -+retry: - res = qb_ipc_us_recv_msghdr(data); -+ if (res == -EAGAIN && ++retry_count < AUTH_RECV_MAX_RETRIES) { -+ struct timespec ts = {0, AUTH_RECV_SLEEP_TIME_US*QB_TIME_NS_IN_USEC}; -+ struct timespec ts_left = {0, 0}; -+ nanosleep(&ts, &ts_left); -+ goto retry; -+ } - - #ifdef QB_LINUX - setsockopt(c->setup.u.us.sock, SOL_SOCKET, SO_PASSCRED, &off, diff --git a/libqb-2.0.6.tar.xz b/libqb-2.0.6.tar.xz deleted file mode 100644 index 9c7406a..0000000 Binary files a/libqb-2.0.6.tar.xz and /dev/null differ diff --git a/libqb-2.0.7.tar.xz b/libqb-2.0.7.tar.xz new file mode 100644 index 0000000..6b0b8d4 Binary files /dev/null and b/libqb-2.0.7.tar.xz differ diff --git a/libqb.spec b/libqb.spec index 646fb5a..8f9ac0c 100644 --- a/libqb.spec +++ b/libqb.spec @@ -1,14 +1,11 @@ Name: libqb -Version: 2.0.6 -Release: 2 +Version: 2.0.7 +Release: 1 Summary: Library providing high performance logging, tracing, ipc, and poll License: LGPLv2+ URL: https://github.com/ClusterLabs/libqb Source0: https://github.com/ClusterLabs/libqb/releases/download/v%{version}/%{name}-%{version}.tar.xz -Patch0: connretry-recv.patch -Patch1: CVE-2023-39976.patch - BuildRequires: autoconf automake libtool check-devel doxygen gcc procps pkgconfig(glib-2.0) BuildRequires: git-core # For doxygen2man @@ -20,8 +17,6 @@ and polling. %prep %setup -q -n %{name}-%{version} -%patch0 -p1 -b .connretry-recv.patch -%patch1 -p1 -b .CVE-2023-39976.patch %build ./autogen.sh @@ -79,6 +74,9 @@ This package contains a program to create nicely-formatted man pages from Doxyge %{_mandir}/man1/doxygen2man.1.gz %changelog +* Tue Jul 18 2023 zouzhimin - 2.0.7-1 +- Upgrade to 2.0.7 + * Mon Aug 14 2023 liningjie - 2.0.6-2 - fix CVE-2023-39976