helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-05-19 02:04:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fcgi: add follow-up patch for CVE-2025-23016

Browse Source 
New release [1] added additional fir for this CVE.

[1] https://github.com/FastCGI-Archives/fcgi2/releases/tag/2.4.7

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This commit is contained in:
Peter Marko 2026-02-22 23:00:26 +01:00 committed by Gyorgy Sarvari
parent 3c1286f8b3
commit 2a61b6dac8
3 changed files with 85 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

0
meta-webserver/recipes-support/fcgi/fcgi/CVE-2025-23016.patch → meta-webserver/recipes-support/fcgi/fcgi/CVE-2025-23016-01.patch
View File

83
meta-webserver/recipes-support/fcgi/fcgi/CVE-2025-23016-02.patch Normal file
View File

@ -0,0 +1,83 @@
From 7c476394e799f39f749d7a7a50f62e5d3ec8db61 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Mon, 19 May 2025 13:49:32 +0200
Subject: [PATCH] Fix size_t overflow in Malloc() argument in ReadParams()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
There were still two issues after commit
b0eabcaf4d4f371514891a52115c746815c2ff15 (Update fcgiapp.c, Fixing an
integer overflow (CVE-2025-23016)):
* Signed int overflow in "nameLen + valueLen + 2" expression.
* Sizes of size_t and int types are in general unrelated.
This fix resolves both of the issues.
Related to CVE-2025-23016.
Resolve #67.
Signed-off-by: Petr Písař <ppisar@redhat.com>
CVE: CVE-2025-23016
Upstream-Status: Backport [https://github.com/FastCGI-Archives/fcgi2/commit/7c476394e799f39f749d7a7a50f62e5d3ec8db61]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
libfcgi/fcgiapp.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/libfcgi/fcgiapp.c b/libfcgi/fcgiapp.c
index 99c3630..0cd3dd1 100644
--- a/libfcgi/fcgiapp.c
+++ b/libfcgi/fcgiapp.c
@@ -18,6 +18,7 @@
#include <memory.h> /* for memchr() */
#include <stdarg.h>
#include <stdio.h>
+#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
@@ -1158,6 +1159,7 @@ char *FCGX_GetParam(const char *name, FCGX_ParamArray envp)
static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
{
int nameLen, valueLen;
+ size_t totalLen;
unsigned char lenBuff[3];
char *nameValue;
@@ -1173,7 +1175,7 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
}
nameLen = ((nameLen & 0x7f) << 24) + (lenBuff[0] << 16)
+ (lenBuff[1] << 8) + lenBuff[2];
- if (nameLen >= INT_MAX) {
+ if (nameLen >= INT_MAX || nameLen >= SIZE_MAX) {
SetError(stream, FCGX_PARAMS_ERROR);
return -1;
}
@@ -1189,16 +1191,21 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
}
valueLen = ((valueLen & 0x7f) << 24) + (lenBuff[0] << 16)
+ (lenBuff[1] << 8) + lenBuff[2];
- if (valueLen >= INT_MAX) {
+ if (valueLen >= INT_MAX || valueLen >= SIZE_MAX) {
SetError(stream, FCGX_PARAMS_ERROR);
return -1;
}
}
+ totalLen = (size_t)nameLen + (size_t)valueLen + 2u;
+ if (totalLen < (size_t)nameLen || totalLen < (size_t)valueLen) {
+ SetError(stream, FCGX_PARAMS_ERROR);
+ return -1;
+ }
/*
* nameLen and valueLen are now valid; read the name and value
* from stream and construct a standard environment entry.
*/
- nameValue = (char *)Malloc(nameLen + valueLen + 2);
+ nameValue = (char *)Malloc(totalLen);
if(FCGX_GetStr(nameValue, nameLen, stream) != nameLen) {
SetError(stream, FCGX_PARAMS_ERROR);
free(nameValue);

3
meta-webserver/recipes-support/fcgi/fcgi_git.bb
View File

@ -7,7 +7,8 @@ SRCREV = "382aa2b0d53a87c27f2f647dfaf670375ba0b85f"
PV = "2.4.2"
SRC_URI = "git://github.com/FastCGI-Archives/fcgi2.git;protocol=https;branch=master \
file://CVE-2025-23016.patch \
file://CVE-2025-23016-01.patch \
file://CVE-2025-23016-02.patch \
"
S = "${WORKDIR}/git"