backport patches to fix bugs
Signed-off-by: xuraoqing <xuraoqing@huawei.com>
This commit is contained in:
xuraoqing
parent
029ea8b56b
commit
988a61df65
51
backport-CLIENT-idmap-fix-coverity-warning.patch
Normal file
51
backport-CLIENT-idmap-fix-coverity-warning.patch
Normal file
@ -0,0 +1,51 @@
|
||||
From 7c913edc84e0201020b5ab770dd0823911387781 Mon Sep 17 00:00:00 2001
|
||||
From: Alexey Tikhonov <atikhono@redhat.com>
|
||||
Date: Wed, 22 May 2024 20:19:05 +0200
|
||||
Subject: [PATCH] CLIENT:idmap: fix coverity warning
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Fixes following issue:
|
||||
```
|
||||
"Error: INTEGER_OVERFLOW (CWE-190):
|
||||
sssd-2.10.0/src/sss_client/idmap/sss_nss_idmap.c:306:5: tainted_data_argument: The value returned in ""replen"" is considered tainted.
|
||||
sssd-2.10.0/src/sss_client/idmap/sss_nss_idmap.c:331:5: overflow: The expression ""replen - 12UL"" might be negative, but is used in a context that treats it as unsigned.
|
||||
sssd-2.10.0/src/sss_client/idmap/sss_nss_idmap.c:331:5: assign: Assigning: ""data_len"" = ""replen - 12UL"".
|
||||
sssd-2.10.0/src/sss_client/idmap/sss_nss_idmap.c:347:9: overflow: The expression ""1UL * data_len"" is deemed underflowed because at least one of its arguments has underflowed.
|
||||
sssd-2.10.0/src/sss_client/idmap/sss_nss_idmap.c:347:9: overflow_sink: ""1UL * data_len"", which might have underflowed, is passed to ""malloc(1UL * data_len)"".
|
||||
# 345| }
|
||||
# 346|
|
||||
# 347|-> str = malloc(sizeof(char) * data_len);
|
||||
# 348| if (str == NULL) {
|
||||
# 349| ret = ENOMEM;"
|
||||
```
|
||||
|
||||
Reviewed-by: Alejandro López <allopez@redhat.com>
|
||||
|
||||
Reference: https://github.com/SSSD/sssd/commit/7c913edc84e0201020b5ab770dd0823911387781
|
||||
Conflict: NA
|
||||
|
||||
---
|
||||
src/sss_client/idmap/sss_nss_idmap.c | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/src/sss_client/idmap/sss_nss_idmap.c b/src/sss_client/idmap/sss_nss_idmap.c
|
||||
index 575d03057..604933c6d 100644
|
||||
--- a/src/sss_client/idmap/sss_nss_idmap.c
|
||||
+++ b/src/sss_client/idmap/sss_nss_idmap.c
|
||||
@@ -324,6 +324,11 @@ static int sss_nss_getyyybyxxx(union input inp, enum sss_cli_command cmd,
|
||||
goto done;
|
||||
}
|
||||
|
||||
+ if (replen < DATA_START) { /* make sure 'type' is present */
|
||||
+ ret = EBADMSG;
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
/* Skip first two 32 bit values (number of results and
|
||||
* reserved padding) */
|
||||
SAFEALIGN_COPY_UINT32(&out->type, repbuf + 2 * sizeof(uint32_t), NULL);
|
||||
--
|
||||
2.33.0
|
||||
|
||||
48
backport-SSH-sanity-check-to-please-coverity.patch
Normal file
48
backport-SSH-sanity-check-to-please-coverity.patch
Normal file
@ -0,0 +1,48 @@
|
||||
From 19df6a5d2ed220e6236aa1c921b7abdeba233dd1 Mon Sep 17 00:00:00 2001
|
||||
From: Alexey Tikhonov <atikhono@redhat.com>
|
||||
Date: Wed, 22 May 2024 21:13:31 +0200
|
||||
Subject: [PATCH] SSH: sanity check to please coverity
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Fixes:
|
||||
```
|
||||
Error: INTEGER_OVERFLOW (CWE-190):
|
||||
sssd-2.10.0/src/util/sss_ssh.c:195:13: underflow: The decrement operator on the unsigned variable ""len"" might result in an underflow.
|
||||
sssd-2.10.0/src/util/sss_ssh.c:204:9: overflow_sink: ""len"", which might have underflowed, is passed to ""memcpy(out, pubkey->data, len)"". [Note: The source code implementation of the function has been overridden by a builtin model.]
|
||||
# 202| }
|
||||
# 203|
|
||||
# 204|-> memcpy(out, pubkey->data, len);
|
||||
# 205| out[len] = '\0';
|
||||
# 206| }
|
||||
```
|
||||
|
||||
Reviewed-by: Alejandro López <allopez@redhat.com>
|
||||
Reviewed-by: Justin Stephenson <jstephen@redhat.com>
|
||||
|
||||
Reference: https://github.com/SSSD/sssd/commit/19df6a5d2ed220e6236aa1c921b7abdeba233dd1
|
||||
Conflict: NA
|
||||
|
||||
---
|
||||
src/util/sss_ssh.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/src/util/sss_ssh.c b/src/util/sss_ssh.c
|
||||
index 9df397873..f9c0918fd 100644
|
||||
--- a/src/util/sss_ssh.c
|
||||
+++ b/src/util/sss_ssh.c
|
||||
@@ -191,6 +191,10 @@ sss_ssh_format_pubkey(TALLOC_CTX *mem_ctx,
|
||||
}
|
||||
|
||||
len = pubkey->data_len;
|
||||
+ if (len == 0) {
|
||||
+ ret = EINVAL;
|
||||
+ goto done;
|
||||
+ }
|
||||
if (pubkey->data[len - 1] == '\n') {
|
||||
len--;
|
||||
}
|
||||
--
|
||||
2.33.0
|
||||
|
||||
11
sssd.spec
11
sssd.spec
@ -8,7 +8,7 @@
|
||||
|
||||
Name: sssd
|
||||
Version: 2.9.4
|
||||
Release: 7
|
||||
Release: 8
|
||||
Summary: System Security Services Daemon
|
||||
License: GPL-3.0-or-later
|
||||
URL: https://github.com/SSSD/sssd/
|
||||
@ -18,8 +18,10 @@ Patch0001: backport-CVE-2023-3758.patch
|
||||
Patch0002: backport-UTILS-inotify-avoid-potential-NULL-deref.patch
|
||||
Patch0003: backport-ad-refresh-root-domain-when-read-directly.patch
|
||||
Patch0004: backport-RESPONDER-use-proper-context-for-getDomains.patch
|
||||
Patch0005: backport-sysdb-do-not-fail-to-add-non-posix-user-to-MPG-domai.patch
|
||||
Patch0006: backport-Update-sssd.in-to-remove-f-option-from-sysv-init-scr.patch
|
||||
Patch0005: backport-SSH-sanity-check-to-please-coverity.patch
|
||||
Patch0006: backport-CLIENT-idmap-fix-coverity-warning.patch
|
||||
Patch0007: backport-sysdb-do-not-fail-to-add-non-posix-user-to-MPG-domai.patch
|
||||
Patch0008: backport-Update-sssd.in-to-remove-f-option-from-sysv-init-scr.patch
|
||||
|
||||
Requires: sssd-ad = %{version}-%{release}
|
||||
Requires: sssd-common = %{version}-%{release}
|
||||
@ -919,6 +921,9 @@ fi
|
||||
%systemd_postun_with_restart sssd.service
|
||||
|
||||
%changelog
|
||||
* Fri Oct 25 2024 xuraoqing <xuraoqing@huawei.com> - 2.9.4-8
|
||||
- backport patches to fix bugs
|
||||
|
||||
* Wed Sep 25 2024 xuraoqing <xuraoqing@huawei.com> - 2.9.4-7
|
||||
- backport patches to fix bugs
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user