main/multipath-tools: add buffer overflow patch from Gentoo

2 files changed, 77 insertions, 3 deletions

diff --git a/main/multipath-tools/APKBUILD b/main/multipath-tools/APKBUILD
index edb28aaffa..f89530c16d 100644
--- a/main/multipath-tools/APKBUILD
+++ b/main/multipath-tools/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Leonardo Arena <rnalrd@alpinelinux.org>
 pkgname="multipath-tools"
 pkgver=0.4.9
-pkgrel=4
+pkgrel=5
 pkgdesc="Device Mapper Multipathing Driver"
 url="http://christophe.varoqui.free.fr/"
 arch="all"
@@ -13,7 +13,10 @@ install=
 subpackages="$pkgname-doc"
 source="http://christophe.varoqui.free.fr/$pkgname/$pkgname-$pkgver.tar.bz2
 	multipath-tools-0.4.9-build.patch
-	multipath-tools-0.4.8-kparted-ext-partitions.patch"
+	multipath-tools-0.4.8-kparted-ext-partitions.patch
+	multipath-tools-0.4.9-log_enquery_overflow.patch
+	multipath-tools-0.4.9-buffer-overflows.patch
+	"
 
 _builddir="$srcdir"
 
@@ -45,4 +48,6 @@ package() {
 
 md5sums="a6d4b48afc28f1f50f5ee4b1b06d2765  multipath-tools-0.4.9.tar.bz2
 751a7e079fef26cced73e2fc31ad7f11  multipath-tools-0.4.9-build.patch
-68ea053e02e9f5c4883b24b3f9bb2bf1  multipath-tools-0.4.8-kparted-ext-partitions.patch"
+68ea053e02e9f5c4883b24b3f9bb2bf1  multipath-tools-0.4.8-kparted-ext-partitions.patch
+00eae05e02f1b85062e998574ab1b833  multipath-tools-0.4.9-log_enquery_overflow.patch
+c5aab36777b0304a3525533cdd31bddc  multipath-tools-0.4.9-buffer-overflows.patch"
diff --git a/main/multipath-tools/multipath-tools-0.4.9-log_enquery_overflow.patch b/main/multipath-tools/multipath-tools-0.4.9-log_enquery_overflow.patch
new file mode 100644
index 0000000000..67367c9f42
--- /dev/null
+++ b/main/multipath-tools/multipath-tools-0.4.9-log_enquery_overflow.patch
@@ -0,0 +1,69 @@
+From e1d69df0cdd1627676501df3a533b25ffadaeff0 Mon Sep 17 00:00:00 2001
+From: Arkadiusz Miskiewicz <arekm@maven.pl>
+Date: Sat, 27 Nov 2010 19:21:21 +0100
+Subject: [PATCH] multipath-tools overflow
+
+On Saturday 27 of November 2010, you wrote:
+
+[...]
+
+> the whole logarea is memset to 0 by logarea_init(), and each dequeued
+> message is also memset to 0 by log_dequeue(), so it seems normal that
+> msg->str value is 0x0, but it's really its address that matters.
+
+Ok, got it. Pointers, memory areas in my debugging session - are looking
+good then.
+
+>
+> It's not clear to me : are you actually hitting a bug or is it your
+> debug session that puzzles you ?
+
+I'm hitting a bug. multipathd dies for me at that strcpy(). Now I think
+the bug is strcpy usage instead of memcpy because I'm building with
+-O2 -D_FORTIFY_SOURCE=2 which turns on special glibc overflow
+detection.
+
+That detection seem to be smart enough to know that &str area is not
+a string memory and aborts the program.
+
+Found similar problem discussed here
+http://sourceware.org/ml/binutils/2005-11/msg00308.html
+
+glibc aborts the program:
+[pid 13432] writev(2, [{"*** ", 4}, {"buffer overflow detected", 24},
+{" ***: ", 6}, {"/home/users/arekm/rpm/BUILD/multipath-tools-0.4.9
+/multipathd/multipathd", 71}, {" terminated\n", 12}], 5) = 117
+
+same for valgrind:
+**13436** *** strcpy_chk: buffer overflow detected ***: program terminated
+==13436==    at 0x4024997: VALGRIND_PRINTF_BACKTRACE (valgrind.h:4477)
+==13436==    by 0x40265F8: __strcpy_chk (mc_replace_strmem.c:781)
+==13436==    by 0x40EDC06: log_enqueue (string3.h:107)
+==13436==    by 0x40ED68A: log_safe (log_pthread.c:24)
+==13436==    by 0x40E296A: dlog (debug.c:36)
+==13436==    by 0x804ECEC: pidfile_create (pidfile.c:37)
+==13436==    by 0x804E731: main (main.c:1424)
+
+The bug is not visible if I run multipathd in debug mode (-d).
+
+This patch fixes the problem for me by avoiding false positive on strcpy_chk.
+---
+ libmultipath/log.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/libmultipath/log.c b/libmultipath/log.c
+index e56e46b..57b7696 100644
+--- a/libmultipath/log.c
++++ b/libmultipath/log.c
+@@ -142,7 +142,7 @@ int log_enqueue (int prio, const char * fmt, va_list ap)
+ 	la->empty = 0;
+ 	msg = (struct logmsg *)la->tail;
+ 	msg->prio = prio;
+-	strcpy((void *)&msg->str, buff);
++	memcpy((void *)&msg->str, buff, strlen(buff) + 1);
+ 	lastmsg->next = la->tail;
+ 	msg->next = la->head;
+ 
+-- 
+1.7.6.5
+