diff options
| author |   Ryan Hill <rhill@gentoo.org> | 2010-10-17 08:46:40 +0000 |
|---|---|---|
| committer | Ryan Hill <rhill@gentoo.org> | 2010-10-17 08:46:40 +0000 |
| commit | 1611ff3e0b18dc7ea4ea1182514e63d4e29df116 (patch) | |
| tree | cce6c1ae45d3cbeda69859899c9d35a8e7b41bcf /4.3.5 | |
| parent | Add patch for bug #335290. (diff) | |
| download | gcc-patches-1611ff3e0b18dc7ea4ea1182514e63d4e29df116.tar.gz gcc-patches-1611ff3e0b18dc7ea4ea1182514e63d4e29df116.tar.bz2 gcc-patches-1611ff3e0b18dc7ea4ea1182514e63d4e29df116.zip | |
Ditto.
Diffstat (limited to '4.3.5')
| -rw-r--r-- | 4.3.5/gentoo/20_all_mudflap-setuid-env.patch | 45 | ||||
| -rw-r--r-- | 4.3.5/gentoo/README.history | 3 |
2 files changed, 47 insertions, 1 deletions
diff --git a/4.3.5/gentoo/20_all_mudflap-setuid-env.patch b/4.3.5/gentoo/20_all_mudflap-setuid-env.patch new file mode 100644 index 0000000..3477370 --- /dev/null +++ b/4.3.5/gentoo/20_all_mudflap-setuid-env.patch @@ -0,0 +1,45 @@ +mudflap accepts options via $MUDFLAP_OPTIONS even when running setuid. + +-viol-gdb option invokes programs upon error detection which is bad. +Note that NULL ptr derefs which are unexploitable in userspace programs, +then become exploitable. + +http://gcc.gnu.org/PR41433 +https://bugs.gentoo.org/335290 + +--- a/libmudflap/mf-runtime.c ++++ b/libmudflap/mf-runtime.c +@@ -303,6 +303,14 @@ __mf_set_default_options () + #ifdef LIBMUDFLAPTH + __mf_opts.thread_stack = 0; + #endif ++ ++ /* PR41443: Beware that the above flags will be applied to ++ setuid/setgid binaries, and cannot be overriden with ++ $MUDFLAP_OPTIONS. So the defaults must be non-exploitable. ++ ++ Should we consider making the default violation_mode something ++ harsher than viol_nop? OTOH, glibc's MALLOC_CHECK_ is disabled ++ by default for these same programs. */ + } + + static struct mudoption +@@ -442,7 +450,7 @@ __mf_usage () + "This is a %s%sGCC \"mudflap\" memory-checked binary.\n" + "Mudflap is Copyright (C) 2002-2010 Free Software Foundation, Inc.\n" + "\n" +- "The mudflap code can be controlled by an environment variable:\n" ++ "Unless setuid, a program's mudflap options be set by an environment variable:\n" + "\n" + "$ export MUDFLAP_OPTIONS='<options>'\n" + "$ <mudflapped_program>\n" +@@ -705,7 +713,8 @@ __mf_init () + + __mf_set_default_options (); + +- ov = getenv ("MUDFLAP_OPTIONS"); ++ if (getuid () == geteuid () && getgid () == getegid ()) /* PR41433, not setuid */ ++ ov = getenv ("MUDFLAP_OPTIONS"); + if (ov) + { + int rc = __mfu_set_options (ov); diff --git a/4.3.5/gentoo/README.history b/4.3.5/gentoo/README.history index 7a6e255..bd1c194 100644 --- a/4.3.5/gentoo/README.history +++ b/4.3.5/gentoo/README.history @@ -1,5 +1,6 @@ -1.1 [pending] +1.1 17.10.2010 + 05_all_pr40010-manpages.patch + + 20_all_mudflap-setuid-env.patch 1.0 09.06.2010 + 00_all_gcc-4.1-alpha-mieee-default.patch |