mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-30 22:11:59 -09:00
0e7daa2717
Backport upstream patch, that was released in GLib 2.84.4 [1],
such that we can apply it onto GLib 2.82 in Buildroot LTS
This fixes the following vulnerability:
- CVE-2025-7039:
A flaw was found in glib. An integer overflow during temporary file
creation leads to an out-of-bounds memory access, allowing an attacker
to potentially perform path traversal or access private temporary file
content by creating symbolic links. This vulnerability allows a local
attacker to manipulate file paths and access unauthorized data. The
core issue stems from insufficient validation of file path lengths
during temporary file operations.
https://www.cve.org/CVERecord?id=CVE-2025-7039
[1] https://gitlab.gnome.org/GNOME/glib/-/releases/2.84.4
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 3252f45279)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
47 lines
1.3 KiB
Diff
47 lines
1.3 KiB
Diff
From 61e963284889ddb4544e6f1d5261c16120f6fcc3 Mon Sep 17 00:00:00 2001
|
|
From: Michael Catanzaro <mcatanzaro@redhat.com>
|
|
Date: Tue, 1 Jul 2025 10:58:07 -0500
|
|
Subject: [PATCH] gfileutils: fix computation of temporary file name
|
|
|
|
We need to ensure that the value we use to index into the letters array
|
|
is always positive.
|
|
|
|
Fixes #3716
|
|
|
|
CVE: CVE-2025-7039
|
|
Upstream: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4674
|
|
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
|
|
---
|
|
glib/gfileutils.c | 8 ++++----
|
|
1 file changed, 4 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/glib/gfileutils.c b/glib/gfileutils.c
|
|
index c7d3339d1c..286b1b154f 100644
|
|
--- a/glib/gfileutils.c
|
|
+++ b/glib/gfileutils.c
|
|
@@ -1538,9 +1538,9 @@ get_tmp_file (gchar *tmpl,
|
|
static const char letters[] =
|
|
"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
|
|
static const int NLETTERS = sizeof (letters) - 1;
|
|
- gint64 value;
|
|
- gint64 now_us;
|
|
- static int counter = 0;
|
|
+ guint64 value;
|
|
+ guint64 now_us;
|
|
+ static guint counter = 0;
|
|
|
|
g_return_val_if_fail (tmpl != NULL, -1);
|
|
|
|
@@ -1559,7 +1559,7 @@ get_tmp_file (gchar *tmpl,
|
|
|
|
for (count = 0; count < 100; value += 7777, ++count)
|
|
{
|
|
- gint64 v = value;
|
|
+ guint64 v = value;
|
|
|
|
/* Fill in the random bits. */
|
|
XXXXXX[0] = letters[v % NLETTERS];
|
|
--
|
|
GitLab
|
|
|