elf: Count components of the expanded path in _dl_init_path [BZ #22607]

(cherry picked from commit 3ff3dfa5af313a6ea33f3393916f30eece4f0171)

diff --git a/ChangeLog b/ChangeLog
index c16512bbc076627b4e2e1849ac191b6254d8ee9e..1868c7a7befedc91dc8e367718d7536a8f77cad9 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2017-12-14  Florian Weimer  <fweimer@redhat.com>
+
+       [BZ #22607]
+       CVE-2017-1000409
+       * elf/dl-load.c (_dl_init_paths): Compute number of components in
+       the expanded path string.
+
 2017-12-14  Florian Weimer  <fweimer@redhat.com>
 
        [BZ #22606]

diff --git a/NEWS b/NEWS
index c0596ae5f24214f191c47f8f5ec1e24d33610f65..2c4c9d63aad9493a664a4f36e868261af58e95b3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -30,6 +30,12 @@ Security related changes:
   it is mentioned here only because of the CVE assignment.)  Reported by
   Qualys.
 
+  CVE-2017-1000409: Buffer overflow in _dl_init_paths due to miscomputation
+  of the number of search path components.  (This is not a security
+  vulnerability per se because no trust boundary is crossed if the fix for
+  CVE-2017-1000366 has been applied, but it is mentioned here only because
+  of the CVE assignment.)  Reported by Qualys.
+
 The following bugs are resolved with this release:
 
   [20257] sunrpc: clntudp_call does not enforce timeout when receiving data

diff --git a/elf/dl-load.c b/elf/dl-load.c
index c8cf96e226f72d7ebc24d9113a625851325f8551..92303b08e6314acb7fa28bced9370b8d01f65d72 100644 (file)
--- a/elf/dl-load.c
+++ b/elf/dl-load.c
@@ -776,8 +776,6 @@ _dl_init_paths (const char *llp)
 
   if (llp != NULL && *llp != '\0')
     {
-      size_t nllp;
-      const char *cp = llp;
       char *llp_tmp;
 
 #ifdef SHARED
@@ -800,13 +798,10 @@ _dl_init_paths (const char *llp)
 
       /* Decompose the LD_LIBRARY_PATH contents.  First determine how many
         elements it has.  */
-      nllp = 1;
-      while (*cp)
-       {
-         if (*cp == ':' || *cp == ';')
-           ++nllp;
-         ++cp;
-       }
+      size_t nllp = 1;
+      for (const char *cp = llp_tmp; *cp != '\0'; ++cp)
+       if (*cp == ':' || *cp == ';')
+         ++nllp;
 
       env_path_list.dirs = (struct r_search_path_elem **)
        malloc ((nllp + 1) * sizeof (struct r_search_path_elem *));