From: Florian Weimer <fweimer@redhat.com>
Date: Thu, 1 Feb 2018 14:00:44 +0000 (+0100)
Subject: Record CVE-2018-6485 in ChangeLog and NEWS [BZ #22343]
X-Git-Tag: glibc-2.27~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4590634fd65162568b9f52fb4beb60aa25da37f2;p=thirdparty%2Fglibc.git

Record CVE-2018-6485 in ChangeLog and NEWS [BZ #22343]
---

diff --git a/ChangeLog b/ChangeLog
index fdf303a42ff..713af78d1d8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -702,6 +702,7 @@
 2018-01-18  Arjun Shankar  <arjun@redhat.com>
 
 	[BZ #22343]
+	CVE-2018-6485
 	* malloc/malloc.c (checked_request2size): call REQUEST_OUT_OF_RANGE
 	after padding.
 	(_int_memalign): check for integer overflow before calling
diff --git a/NEWS b/NEWS
index 5c27f5c3328..70798f6ced2 100644
--- a/NEWS
+++ b/NEWS
@@ -258,6 +258,10 @@ Security related changes:
   succeeds without returning an absolute path due to unexpected behaviour
   of the Linux kernel getcwd syscall.  Reported by halfdog.
 
+  CVE-2018-6485: The posix_memalign and memalign functions, when called with
+  an object size near the value of SIZE_MAX, would return a pointer to a
+  buffer which is too small, instead of NULL.  Reported by Jakub Wilk.
+
 The following bugs are resolved with this release:
 
   [The release manager will add the list generated by