diff --git a/SOURCES/glibc-rh1213603.patch b/SOURCES/glibc-rh1213603.patch new file mode 100644 index 0000000..3b14dbd --- /dev/null +++ b/SOURCES/glibc-rh1213603.patch @@ -0,0 +1,41 @@ +commit 31d0a4fa646db8b8c97ce24e0ec0a7b73de4fca1 +Author: Florian Weimer +Date: Sat Jun 11 12:12:56 2016 +0200 + + nss_db: Fix initialization of iteration position [BZ #20237] + + When get*ent is called without a preceding set*ent, we need + to set the initial iteration position in get*ent. + + Reproducer: Add “services: db files” to /etc/nsswitch.conf, then run + “perl -e getservent”. It will segfault before this change, and exit + silently after it. + +Index: b/nss/nss_db/db-XXX.c +=================================================================== +--- a/nss/nss_db/db-XXX.c ++++ b/nss/nss_db/db-XXX.c +@@ -76,7 +76,7 @@ CONCAT(_nss_db_set,ENTNAME) (int stayope + keep_db |= stayopen; + + /* Reset the sequential index. */ +- entidx = (const char *) state.header + state.header->valstroffset; ++ entidx = NULL; + } + + __libc_lock_unlock (lock); +@@ -249,8 +249,14 @@ CONCAT(_nss_db_get,ENTNAME_r) (struct ST + H_ERRNO_SET (NETDB_INTERNAL); + goto out; + } ++ entidx = NULL; + } + ++ /* Start from the beginning if freshly initialized or reset ++ requested by set*ent. */ ++ if (entidx == NULL) ++ entidx = (const char *) state.header + state.header->valstroffset; ++ + status = NSS_STATUS_UNAVAIL; + if (state.header != MAP_FAILED) + { diff --git a/SOURCES/glibc-rh1318890.patch b/SOURCES/glibc-rh1318890.patch new file mode 100644 index 0000000..f091765 --- /dev/null +++ b/SOURCES/glibc-rh1318890.patch @@ -0,0 +1,36 @@ +commit a6033052d08027f745867e5e346852da1959226c +Author: Florian Weimer +Date: Tue Mar 29 11:27:32 2016 +0200 + + nss_db: Propagate ERANGE error if parse_line fails [BZ #19837] + + Reproducer (needs to run as root): + + perl -e \ + 'print "large:x:999:" . join(",", map {"user$_"} (1 .. 135))."\n"' \ + >> /etc/group + cd /var/db + make + getent -s db group + + After the fix, the last command should list the "large" group. + + The magic number 135 has been chosen so that the line is shorter than + 1024 bytes, but the pointers required to encode the member array will + cross the threshold, triggering the bug. + +Index: b/nss/nss_db/db-XXX.c +=================================================================== +--- a/nss/nss_db/db-XXX.c ++++ b/nss/nss_db/db-XXX.c +@@ -284,8 +284,8 @@ CONCAT(_nss_db_get,ENTNAME_r) (struct ST + } + if (err < 0) + { +- H_ERRNO_SET (HOST_NOT_FOUND); +- status = NSS_STATUS_NOTFOUND; ++ H_ERRNO_SET (NETDB_INTERNAL); ++ status = NSS_STATUS_TRYAGAIN; + break; + } + diff --git a/SOURCES/glibc-rh1366569.patch b/SOURCES/glibc-rh1366569.patch new file mode 100644 index 0000000..c69b733 --- /dev/null +++ b/SOURCES/glibc-rh1366569.patch @@ -0,0 +1,16 @@ +Do not set initgroups. The commented-out setting reflects the +glibc default (derived from group). + +Index: b/releng/nsswitch.conf +=================================================================== +--- a/releng/nsswitch.conf ++++ b/releng/nsswitch.conf +@@ -33,7 +33,7 @@ + passwd: files sss + shadow: files sss + group: files sss +-initgroups: files ++#initgroups: files sss + + #hosts: db files nisplus nis dns + hosts: files dns diff --git a/SOURCES/glibc-rh1370630.patch b/SOURCES/glibc-rh1370630.patch new file mode 100644 index 0000000..30d3d4f --- /dev/null +++ b/SOURCES/glibc-rh1370630.patch @@ -0,0 +1,65 @@ +commit 4969890247d7d6a548f17641ed5a18f4b713d211 +Author: Alexandre Oliva +Date: Fri Nov 21 03:29:56 2014 -0200 + + BZ#14498: fix infinite loop in nss_db_getservbyname + + nss_db uses nss_files code for services, but a continue on protocol + mismatch that doesn't affect nss_files skipped the code that advanced + to the next db entry. Any one of these changes would suffice to fix + it, but fixing both makes them both safer to reuse elsewhere. + + for ChangeLog + + [BZ #14498] + * NEWS: Fixed. + * nss/nss_db/db-XXX.c (_nss_db_get##name##_r): Update hidx + after parsing line but before break_if_match. + * nss/nss_files/files-service (DB_LOOKUP): Don't "continue;" + if there is a protocol mismatch. + +Index: b/nss/nss_db/db-XXX.c +=================================================================== +--- a/nss/nss_db/db-XXX.c ++++ b/nss/nss_db/db-XXX.c +@@ -190,6 +190,12 @@ enum nss_status \ + char *p = memcpy (buffer, valstr, len); \ + \ + int err = parse_line (p, result, data, buflen, errnop EXTRA_ARGS); \ ++ \ ++ /* Advance before break_if_match, lest it uses continue to skip ++ to the next entry. */ \ ++ if ((hidx += hval2) >= header->dbs[i].hashsize) \ ++ hidx -= header->dbs[i].hashsize; \ ++ \ + if (err > 0) \ + { \ + status = NSS_STATUS_SUCCESS; \ +@@ -202,9 +208,6 @@ enum nss_status \ + status = NSS_STATUS_TRYAGAIN; \ + break; \ + } \ +- \ +- if ((hidx += hval2) >= header->dbs[i].hashsize) \ +- hidx -= header->dbs[i].hashsize; \ + } \ + \ + if (status == NSS_STATUS_NOTFOUND) \ +Index: b/nss/nss_files/files-service.c +=================================================================== +--- a/nss/nss_files/files-service.c ++++ b/nss/nss_files/files-service.c +@@ -44,8 +44,11 @@ DB_LOOKUP (servbyname, ':', + { + /* Must match both protocol (if specified) and name. */ + if (proto != NULL && strcmp (result->s_proto, proto)) +- continue; +- LOOKUP_NAME (s_name, s_aliases) ++ /* A continue statement here breaks nss_db, because it ++ bypasses advancing to the next db entry, and it ++ doesn't make nss_files any more efficient. */; ++ else ++ LOOKUP_NAME (s_name, s_aliases) + }, + const char *name, const char *proto) + diff --git a/SPECS/glibc.spec b/SPECS/glibc.spec index c7c7c57..eb8e8d5 100644 --- a/SPECS/glibc.spec +++ b/SPECS/glibc.spec @@ -1,6 +1,6 @@ %define glibcsrcdir glibc-2.17-c758a686 %define glibcversion 2.17 -%define glibcrelease 157%{?dist} +%define glibcrelease 157%{?dist}.1 ############################################################################## # We support the following options: # --with/--without, @@ -997,6 +997,14 @@ Patch2071: glibc-rh1335925-2.patch Patch2072: glibc-rh1335925-3.patch Patch2073: glibc-rh1335925-4.patch +# Do not set initgroups in default nsswitch.conf +Patch2074: glibc-rh1366569.patch + +# Various nss_db fixes +Patch2075: glibc-rh1318890.patch +Patch2076: glibc-rh1213603.patch +Patch2077: glibc-rh1370630.patch + ############################################################################## # End of glibc patches. ############################################################################## @@ -1605,6 +1613,10 @@ package or when debugging this package. %patch2071 -p1 %patch2072 -p1 %patch2073 -p1 +%patch2074 -p1 +%patch2075 -p1 +%patch2076 -p1 +%patch2077 -p1 # Rebase of microbenchmarks. %patch1607 -p1 %patch1609 -p1 @@ -2939,6 +2951,12 @@ rm -f *.filelist* %endif %changelog +* Thu Oct 27 2016 Carlos O'Donell - 2.17-157.1 +- Do not set initgroups in default nsswitch.conf (#1388638) +- nss_db: Request larger buffers for long group entries (#1388637) +- nss_db: Fix get*ent crash without preceding set*ent (#1388635) +- nss_db: Fix endless loop in services database processing (#1388639) + * Thu Aug 11 2016 Florian Weimer - 2.17-157 - Rebuild with updated binutils (#1268008)