From: Joseph Myers <joseph@codesourcery.com>
Date: Mon, 22 Oct 2018 12:08:12 +0000 (+0200)
Subject: Fix nscd readlink argument aliasing (bug 22446).
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=935cecfe9a4c9bf0396766f5e2b24570f92317ae;p=thirdparty%2Fglibc.git

Fix nscd readlink argument aliasing (bug 22446).

Current GCC mainline detects that nscd calls readlink with the same
buffer for both input and output, which is not valid (those arguments
are both restrict-qualified in POSIX).  This patch makes it use a
separate buffer for readlink's input (with a size that is sufficient
to avoid truncation, so there should be no problems with warnings
about possible truncation, though not strictly minimal, but much
smaller than the buffer for output) to avoid this problem.

Tested compilation for aarch64-linux-gnu with build-many-glibcs.py.

	[BZ #22446]
	* nscd/connections.c (handle_request) [SO_PEERCRED]: Use separate
	buffers for readlink input and output.

(cherry picked from commit 49b036bce9f021ae994a85aee8b410d20b29c8b7)
---

diff --git a/ChangeLog b/ChangeLog
index 49bcd10abc0..0b7a9206735 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2017-12-18  Joseph Myers  <joseph@codesourcery.com>
+
+	[BZ #22446]
+	* nscd/connections.c (handle_request) [SO_PEERCRED]: Use separate
+	buffers for readlink input and output.
+
 2017-12-15  Steve Ellcey  <sellcey@cavium.com>
 
 	* nscd/dbg_log.c (dbg_log): Increase msg buffer size.
diff --git a/NEWS b/NEWS
index fecdbdf103e..f6c9a1412cc 100644
--- a/NEWS
+++ b/NEWS
@@ -127,6 +127,7 @@ The following bugs are resolved with this release:
   [22375] malloc returns pointer from tcache instead of NULL (CVE-2017-17426)
   [22377] Provide a C++ version of iseqsig
   [22442] if_nametoindex: Check length of ifname before copying it
+  [22446] Fix nscd readlink argument aliasing
   [22447] Avoid use of strlen in getlogin_r
   [22463] Fix p_secstodate overflow handling
   [22627] $ORIGIN in $LD_LIBRARY_PATH is substituted twice
diff --git a/nscd/connections.c b/nscd/connections.c
index cc1ed720776..dab722dcb2f 100644
--- a/nscd/connections.c
+++ b/nscd/connections.c
@@ -1077,14 +1077,15 @@ cannot handle old request version %d; current version is %d"),
       if (debug_level > 0)
 	{
 #ifdef SO_PEERCRED
+	  char pbuf[sizeof ("/proc//exe") + 3 * sizeof (long int)];
 # ifdef PATH_MAX
 	  char buf[PATH_MAX];
 # else
 	  char buf[4096];
 # endif
 
-	  snprintf (buf, sizeof (buf), "/proc/%ld/exe", (long int) pid);
-	  ssize_t n = readlink (buf, buf, sizeof (buf) - 1);
+	  snprintf (pbuf, sizeof (pbuf), "/proc/%ld/exe", (long int) pid);
+	  ssize_t n = readlink (pbuf, buf, sizeof (buf) - 1);
 
 	  if (n <= 0)
 	    dbg_log (_("\