From fcb95181298f28af678d31bb69b96bffde2be49b Mon Sep 17 00:00:00 2001
From: yangmingtaip <yangmingtai@huawei.com>
Date: Mon, 7 Nov 2022 17:17:20 +0800
Subject: [PATCH] fix CVE-2022-3821

(cherry picked from commit 4f0bd04bd2854ed0977738b537026efc9bdba535)
---
 backport-fix-CVE-2022-3821.patch | 45 ++++++++++++++++++++++++++++++++
 systemd.spec                     |  6 ++++-
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 backport-fix-CVE-2022-3821.patch

diff --git a/backport-fix-CVE-2022-3821.patch b/backport-fix-CVE-2022-3821.patch
new file mode 100644
index 0000000..0c26aa6
--- /dev/null
+++ b/backport-fix-CVE-2022-3821.patch
@@ -0,0 +1,45 @@
+From 8d2d0895229cfbe39c1c5c16e61e426812a72e8b Mon Sep 17 00:00:00 2001
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Thu, 7 Jul 2022 18:27:02 +0900
+Subject: [PATCH] time-util: fix buffer-over-run
+
+Fixes #23928.
+Conflict:adapt test context
+Reference:https://github.com/systemd/systemd/pull/23933/commits/8d2d0895229cfbe39c1c5c16e61e426812a72e8b
+---
+ src/basic/time-util.c     | 2 +-
+ src/test/test-time-util.c | 5 +++++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/basic/time-util.c b/src/basic/time-util.c
+index 5d162e8..2cc0b92 100644
+--- a/src/basic/time-util.c
++++ b/src/basic/time-util.c
+@@ -590,7 +590,7 @@ char *format_timespan(char *buf, size_t l, usec_t t, usec_t accuracy) {
+                         t = b;
+                 }
+ 
+-                n = MIN((size_t) k, l);
++                n = MIN((size_t) k, l-1);
+ 
+                 l -= n;
+                 p += n;
+diff --git a/src/test/test-time-util.c b/src/test/test-time-util.c
+index 6f4675a..d7cb71c 100644
+--- a/src/test/test-time-util.c
++++ b/src/test/test-time-util.c
+@@ -241,6 +241,11 @@ static void test_format_timespan(usec_t accuracy) {
+         test_format_timespan_one(500 * USEC_PER_MSEC, accuracy);
+         test_format_timespan_one(9*USEC_PER_YEAR/5 - 23, accuracy);
+         test_format_timespan_one(USEC_INFINITY, accuracy);
++
++        /* See issue #23928. */
++        _cleanup_free_ char *buf;
++        assert_se(buf = new(char, 5));
++        assert_se(buf == format_timespan(buf, 5, 100005, 1000));
+ }
+ 
+ static void test_verify_timezone(void) {
+-- 
+2.27.0
+
diff --git a/systemd.spec b/systemd.spec
index 71007f2..1e77e7b 100644
--- a/systemd.spec
+++ b/systemd.spec
@@ -20,7 +20,7 @@
 Name:           systemd
 Url:            https://www.freedesktop.org/wiki/Software/systemd
 Version:        249
-Release:        39
+Release:        40
 License:        MIT and LGPLv2+ and GPLv2+
 Summary:        System and Service Manager
 
@@ -411,6 +411,7 @@ Patch6362:      backport-meson.build-change-operator-combining-bools-from-to-.pa
 Patch6363:      backport-core-replace-slice-dependencies-as-they-get-added.patch
 Patch6364:      backport-scsi_id-retry-inquiry-ioctl-if-host_byte-is-DID_TRAN.patch
 Patch6365:      backport-revert-units-add-ProtectClock-yes.patch
+Patch6366:      backport-fix-CVE-2022-3821.patch
 
 Patch9001:      update-rtc-with-system-clock-when-shutdown.patch
 Patch9002:      udev-add-actions-while-rename-netif-failed.patch
@@ -1852,6 +1853,9 @@ fi
 %{_libdir}/security/pam_systemd.so
 
 %changelog
+* Mon Nov 7 2022 yangmingtai <yangmingtai@huawei.com> -249-40
+- fix CVE-2022-3821
+
 * Thu Oct 27 2022 wuzx<wuzx1226@qq.com> - 249-39
 - Add sw64 architecture