Commit 94e01571507835ff59dd8ce2a0b56a4b566965a4
2017-04-24T01:43:36
time_rz: fix heap buffer overflow vulnerability This issue has been assigned CVE-2017-7476 and was detected with American Fuzzy Lop 2.41b run on the coreutils date(1) program with ASAN enabled. ERROR: AddressSanitizer: heap-buffer-overflow on address 0x... WRITE of size 8 at 0x60d00000cff8 thread T0 #1 0x443020 in extend_abbrs lib/time_rz.c:88 #2 0x443356 in save_abbr lib/time_rz.c:155 #3 0x44393f in localtime_rz lib/time_rz.c:290 #4 0x41e4fe in parse_datetime2 lib/parse-datetime.y:1798 A minimized reproducer is the following 120 byte TZ value, which goes beyond the value of ABBR_SIZE_MIN (119) on x86_64. Extend the aa...b portion to overwrite more of the heap. date -d $(printf 'TZ="aaa%020daaaaaab%089d"') localtime_rz and mktime_z were affected since commit 4bc76593. parse_datetime was affected since commit 4e6e16b3f. * lib/time_rz.c (save_abbr): Rearrange the calculation determining whether there is enough buffer space available. The rearrangement ensures we're only dealing with positive numbers, thus avoiding the problematic promotion of signed to unsigned causing an invalid comparison when zone_copy is more than ABBR_SIZE_MIN bytes beyond the start of the buffer. * tests/test-parse-datetime.c (main): Add a test case written by Paul Eggert, which overwrites enough of the heap so that standard glibc will fail with "free(): invalid pointer" without the patch applied. Reported and analyzed at https://bugzilla.redhat.com/1444774