0001-Apply-patch-to-fix-CVE-2016-6318.patch 3.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105
  1. From 47e5dec521ab6243c9b249dd65b93d232d90d6b1 Mon Sep 17 00:00:00 2001
  2. From: Jan Dittberner <jan@dittberner.info>
  3. Date: Thu, 25 Aug 2016 17:13:49 +0200
  4. Subject: [PATCH] Apply patch to fix CVE-2016-6318
  5. This patch fixes an issue with a stack-based buffer overflow when
  6. parsing large GECOS field. See
  7. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6318 and
  8. https://security-tracker.debian.org/tracker/CVE-2016-6318 for more
  9. information.
  10. Upstream-Status: Backport [https://github.com/cracklib/cracklib/commit/47e5dec521ab6243c9b249dd65b93d232d90d6b1]
  11. CVE: CVE-2016-6318
  12. Signed-off-by: Dengke Du <dengke.du@windriver.com>
  13. ---
  14. lib/fascist.c | 57 ++++++++++++++++++++++++++++++++-----------------------
  15. 1 file changed, 33 insertions(+), 24 deletions(-)
  16. diff --git a/lib/fascist.c b/lib/fascist.c
  17. index a996509..d4deb15 100644
  18. --- a/lib/fascist.c
  19. +++ b/lib/fascist.c
  20. @@ -502,7 +502,7 @@ FascistGecosUser(char *password, const char *user, const char *gecos)
  21. char gbuffer[STRINGSIZE];
  22. char tbuffer[STRINGSIZE];
  23. char *uwords[STRINGSIZE];
  24. - char longbuffer[STRINGSIZE * 2];
  25. + char longbuffer[STRINGSIZE];
  26. if (gecos == NULL)
  27. gecos = "";
  28. @@ -583,38 +583,47 @@ FascistGecosUser(char *password, const char *user, const char *gecos)
  29. {
  30. for (i = 0; i < j; i++)
  31. {
  32. - strcpy(longbuffer, uwords[i]);
  33. - strcat(longbuffer, uwords[j]);
  34. -
  35. - if (GTry(longbuffer, password))
  36. + if (strlen(uwords[i]) + strlen(uwords[j]) < STRINGSIZE)
  37. {
  38. - return _("it is derived from your password entry");
  39. - }
  40. + strcpy(longbuffer, uwords[i]);
  41. + strcat(longbuffer, uwords[j]);
  42. - strcpy(longbuffer, uwords[j]);
  43. - strcat(longbuffer, uwords[i]);
  44. + if (GTry(longbuffer, password))
  45. + {
  46. + return _("it is derived from your password entry");
  47. + }
  48. - if (GTry(longbuffer, password))
  49. - {
  50. - return _("it's derived from your password entry");
  51. - }
  52. + strcpy(longbuffer, uwords[j]);
  53. + strcat(longbuffer, uwords[i]);
  54. - longbuffer[0] = uwords[i][0];
  55. - longbuffer[1] = '\0';
  56. - strcat(longbuffer, uwords[j]);
  57. + if (GTry(longbuffer, password))
  58. + {
  59. + return _("it's derived from your password entry");
  60. + }
  61. + }
  62. - if (GTry(longbuffer, password))
  63. + if (strlen(uwords[j]) < STRINGSIZE - 1)
  64. {
  65. - return _("it is derivable from your password entry");
  66. + longbuffer[0] = uwords[i][0];
  67. + longbuffer[1] = '\0';
  68. + strcat(longbuffer, uwords[j]);
  69. +
  70. + if (GTry(longbuffer, password))
  71. + {
  72. + return _("it is derivable from your password entry");
  73. + }
  74. }
  75. - longbuffer[0] = uwords[j][0];
  76. - longbuffer[1] = '\0';
  77. - strcat(longbuffer, uwords[i]);
  78. -
  79. - if (GTry(longbuffer, password))
  80. + if (strlen(uwords[i]) < STRINGSIZE - 1)
  81. {
  82. - return _("it's derivable from your password entry");
  83. + longbuffer[0] = uwords[j][0];
  84. + longbuffer[1] = '\0';
  85. + strcat(longbuffer, uwords[i]);
  86. +
  87. + if (GTry(longbuffer, password))
  88. + {
  89. + return _("it's derivable from your password entry");
  90. + }
  91. }
  92. }
  93. }
  94. --
  95. 2.8.1