packaging/05-restore_crash_on_malformed_input.patch

   1 commit a1815d4ad4ffe84e8f7d128a38955e3dab306e0d
   2 Author: Markus Steinborn <msteinbo>
   3 Date:   Thu Dec 17 16:24:17 2009 -0800
   4
   5     setfacl: fix restore crash on malformed input
   6
   7     Malformed input to setfacl --restore can cause a crash due to a double
   8     free.
   9
  10     Ensure that freed memory is set to NULL.
  11
  12     Fixes this bug:
  13      https://savannah.nongnu.org/bugs/index.php?28185
  14
  15     Signed-off-by: Brandon Philips <bphilips@suse.de>
  16
  17 diff --git a/setfacl/parse.c b/setfacl/parse.c
  18 index b333beb..e7e6add 100644
  19 --- a/setfacl/parse.c
  20 +++ b/setfacl/parse.c
  21 @@ -525,8 +525,10 @@ read_acl_comments(
  22                 return -1;
  23         return comments_read;
  24  fail:
  25 -       if (path_p && *path_p)
  26 +       if (path_p && *path_p) {
  27                 free(*path_p);
  28 +               *path_p = NULL;
  29 +       }
  30         return -EINVAL;
  31  }
  32
  33 diff --git a/test/Makefile b/test/Makefile
  34 index 828b6a4..0c6ee3e 100644
  35 --- a/test/Makefile
  36 +++ b/test/Makefile
  37 @@ -22,7 +22,8 @@ include $(TOPDIR)/include/builddefs
  38  TESTS = $(wildcard *.test)
  39  ROOT = $(wildcard root/*.test)
  40  NFS = $(wildcard nfs/*.test)
  41 -LSRCFILES = sort-getfacl-output run make-tree $(TESTS) $(ROOT) $(NFS)
  42 +LSRCFILES = sort-getfacl-output run make-tree $(TESTS) $(ROOT) $(NFS) \
  43 +       test/malformed-restore-double-owner.acl
  44
  45  include $(BUILDRULES)
  46
  47 diff --git a/test/malformed-restore-double-owner.acl b/test/malformed-restore-double-owner.acl
  48 new file mode 100644
  49 index 0000000..1981de2
  50 --- /dev/null
  51 +++ b/test/malformed-restore-double-owner.acl
  52 @@ -0,0 +1,8 @@
  53 +# file: tmp
  54 +# owner: USER
  55 +# owner: USER
  56 +# group: GROUP
  57 +user::rwx
  58 +group::rwx
  59 +other::rwx
  60 +
  61 diff --git a/test/malformed-restore.test b/test/malformed-restore.test
  62 new file mode 100644
  63 index 0000000..e92b75b
  64 --- /dev/null
  65 +++ b/test/malformed-restore.test
  66 @@ -0,0 +1,19 @@
  67 +Test for malformed input to --restore
  68 + https://savannah.nongnu.org/bugs/index.php?28185
  69 +
  70 +       $ cp malformed-restore-double-owner.acl tmp.acl
  71 +       $ sed -i "s/USER/%TUSER/g" tmp.acl
  72 +       $ sed -i "s/GROUP/%TGROUP/g" tmp.acl
  73 +       $ touch tmp
  74 +       $ setfacl --restore tmp.acl
  75 +       > setfacl: tmp.acl: Invalid argument
  76 +       $ rm tmp.acl tmp
  77 +
  78 +       $ mkdir tmp
  79 +       $ chmod 1777 tmp
  80 +       $ getfacl tmp > tmp.acl
  81 +       $ sed -i 's/--t/--x/g' tmp.acl
  82 +       $ setfacl --restore tmp.acl
  83 +       > setfacl: tmp.acl: Invalid argument
  84 +       $ rmdir tmp
  85 +       $ rm tmp.acl