Bug 9012

Summary: CVE-2016-2090; Heap buffer overflow in fgetwln function of libbsd
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Armin Kuster <akuster>
Component: coreAssignee: Armin Kuster <akuster>
Status: VERIFIED FIXED QA Contact: Bogdan Alexandru Voiculescu <bogdanx.a.voiculescu>
Severity: normal    
Priority: Medium CC: bogdanx.a.voiculescu, meta.mr.watcher, meta.watcher
Version: 2.1   
Target Milestone: 2.1 M3   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: Don't know

Description Armin Kuster 2016-01-28 15:52:18 UTC 
https://blog.fuzzing-project.org/36-Heap-buffer-overflow-in-fgetwln-function-of-libbsd.html

libbsd is a library to provide common functions from BSD systems on
Linux.

libbsd 0.8.1 and earlier contains a buffer overflow in the function
fgetwln(). An if checks if it is necessary to reallocate memory in the
target buffer. However this check is off by one, therefore an out of
bounds write happens.

Upstream has released version 0.8.2 to fix this.

I have checked where this function gets used. I didn't find any code
using it, so I assume the impact is limited.

This bug was found with the help of Address Sanitizer.

https://bugs.freedesktop.org/show_bug.cgi?id=93881
http://cgit.freedesktop.org/libbsd/commit/?id=c8f0723d2b4520bdd6b9eb7c3e7976de726d7ff7
Comment 1 Armin Kuster 2016-01-28 16:07:37 UTC 
master: is at 0.8.1
jethro and fido: 0.7.0
Comment 3 Bogdan Alexandru Voiculescu 2016-05-11 07:02:06 UTC 
Verified on: 
fido: 6b2102cd59c1ac48b8550dbbea0b83eada7e7b32
jethro: 6b2102cd59c1ac48b8550dbbea0b83eada7e7b32
master 7ca60ec8bff7656b4e52f5a4d238913e851da089