Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package rsync for openSUSE:Factory checked
in at 2023-09-14 16:24:59
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/rsync (Old)
and /work/SRC/openSUSE:Factory/.rsync.new.1766 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rsync"
Thu Sep 14 16:24:59 2023 rev:85 rq:1110901 version:3.2.7
Changes:
--------
--- /work/SRC/openSUSE:Factory/rsync/rsync.changes 2023-09-12
21:02:01.518339181 +0200
+++ /work/SRC/openSUSE:Factory/.rsync.new.1766/rsync.changes 2023-09-14
16:26:30.784398510 +0200
@@ -1,0 +2,6 @@
+Wed Sep 6 09:52:41 UTC 2023 - David Anes <david.a...@suse.com>
+
+- Rename patch to follow naming patch policies:
+ fortified-strlcpy-fix.patch -> rsync-fortified-strlcpy-fix.patch
+
+-------------------------------------------------------------------
@@ -11 +17 @@
-- add fortified-strlcpy-fix.patch (bsc#1214616)
+- add fortified-strlcpy-fix.patch (bsc#1214616, bsc#1214249)
Old:
----
fortified-strlcpy-fix.patch
New:
----
rsync-fortified-strlcpy-fix.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ rsync.spec ++++++
--- /var/tmp/diff_new_pack.mD3sBq/_old 2023-09-14 16:26:32.760469102 +0200
+++ /var/tmp/diff_new_pack.mD3sBq/_new 2023-09-14 16:26:32.760469102 +0200
@@ -55,7 +55,7 @@
Source12: %{name}.keyring
Source13: rsyncd
Patch0: rsync-no-libattr.patch
-Patch1: fortified-strlcpy-fix.patch
+Patch1: rsync-fortified-strlcpy-fix.patch
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: c++_compiler
++++++ rsync-fortified-strlcpy-fix.patch ++++++
>From 1f83963f59960150e8c46112daa8411324c1f209 Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jsl...@suse.cz>
Date: Fri, 18 Aug 2023 08:26:20 +0200
Subject: [PATCH] exclude: fix crashes with fortified strlcpy()
Fortified (-D_FORTIFY_SOURCE=2 for gcc) builds make strlcpy() crash when
its third parameter (size) is larger than the buffer:
$ rsync -FFXHav '--filter=merge global-rsync-filter' Align-37-43/ xxx
sending incremental file list
*** buffer overflow detected ***: terminated
It's in the exclude code in setup_merge_file():
strlcpy(y, save, MAXPATHLEN);
Note the 'y' pointer was incremented, so it no longer points to memory
with MAXPATHLEN "owned" bytes.
Fix it by remembering the number of copied bytes into the 'save' buffer
and use that instead of MAXPATHLEN which is clearly incorrect.
Fixes #511.
---
exclude.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/exclude.c b/exclude.c
index ffe55b167..1a5de3b9e 100644
--- a/exclude.c
+++ b/exclude.c
@@ -720,7 +720,8 @@ static BOOL setup_merge_file(int mergelist_num, filter_rule
*ex,
parent_dirscan = True;
while (*y) {
char save[MAXPATHLEN];
- strlcpy(save, y, MAXPATHLEN);
+ /* copylen is strlen(y) which is < MAXPATHLEN. +1 for \0 */
+ size_t copylen = strlcpy(save, y, MAXPATHLEN) + 1;
*y = '\0';
dirbuf_len = y - dirbuf;
strlcpy(x, ex->pattern, MAXPATHLEN - (x - buf));
@@ -734,7 +735,7 @@ static BOOL setup_merge_file(int mergelist_num, filter_rule
*ex,
lp->head = NULL;
}
lp->tail = NULL;
- strlcpy(y, save, MAXPATHLEN);
+ strlcpy(y, save, copylen);
while ((*x++ = *y++) != '/') {}
}
parent_dirscan = False;
