{"push_id":2464630923,"size":11,"distinct_size":0,"ref":"refs/heads/release/2.22/master","head":"017d97cd2ec0f626f8afb8c73ea3d612d8e844c3","before":"771fb81f98a2be9e96f2a09056617ad93d64959f","commits":[{"sha":"1be1845b280cfadff0cbd09170af554549849ffb","author":{"name":"Arjun Shankar","email":"1a59e0ce01eb1f3f09608f507589cca78519dd39@lostca.se"},"message":"Synchronize support/ infrastructure with master\n\nThis commit updates the support/ subdirectory to\ncommit 2714c5f3c95f90977167c1d21326d907fb76b419\non the master branch and modifies Makeconfig,\nRules, and extra-lib.mk accordingly.\n\n(cherry picked from commit 4c5785aa129a5d195fc1cd5c7fcd6f62c2b0ff0c)\n\nReviewed-by: Carlos O'Donell <carlos@redhat.com>","distinct":false,"url":"https://api.github.com/repos/bminor/glibc/commits/1be1845b280cfadff0cbd09170af554549849ffb"},{"sha":"89dc0372bb497b7d51bcf9999ce3f9684d450959","author":{"name":"Andreas Schwab","email":"c9df6394cb541f693236245820fbe23866f1a3fe@suse.de"},"message":"ldd: never run file directly\n\n(cherry picked from commit eedca9772e99c72ab4c3c34e43cc764250aa3e3c)","distinct":false,"url":"https://api.github.com/repos/bminor/glibc/commits/89dc0372bb497b7d51bcf9999ce3f9684d450959"},{"sha":"9d0aec236891576c7f12e935128364669b785233","author":{"name":"Florian Weimer","email":"a228da394793d2e6e5b1b6a5525945d856f25556@redhat.com"},"message":"sunrpc: Avoid use-after-free read access in clntudp_call [BZ #21115]\n\nAfter commit bc779a1a5b3035133024b21e2f339fe4219fb11c\n(CVE-2016-4429: sunrpc: Do not use alloca in clntudp_call\n[BZ #20112]), ancillary data is stored on the heap,\nbut it is accessed after it has been freed.\n\nThe test case must be run under a heap debugger such as valgrind\nto observe the invalid access.  A malloc implementation which\nimmediately calls munmap on free would catch this bug as well.\n\n(cherry picked from commit d42eed4a044e5e10dfb885cf9891c2518a72a491)","distinct":false,"url":"https://api.github.com/repos/bminor/glibc/commits/9d0aec236891576c7f12e935128364669b785233"},{"sha":"21c5d14bfb4e08bee86f94fd815535d3be2c3869","author":{"name":"Aurelien Jarno","email":"bceb368e7f2cb351af47298f32034f0587bbe4a6@aurel32.net"},"message":"elf: Check for empty tokens before dynamic string token expansion [BZ #22625]\n\nThe fillin_rpath function in elf/dl-load.c loops over each RPATH or\nRUNPATH tokens and interprets empty tokens as the current directory\n(\"./\"). In practice the check for empty token is done *after* the\ndynamic string token expansion. The expansion process can return an\nempty string for the $ORIGIN token if __libc_enable_secure is set\nor if the path of the binary can not be determined (/proc not mounted).\n\nFix that by moving the check for empty tokens before the dynamic string\ntoken expansion. In addition, check for NULL pointer or empty strings\nreturn by expand_dynamic_string_token.\n\nThe above changes highlighted a bug in decompose_rpath, an empty array\nis represented by the first element being NULL at the fillin_rpath\nlevel, but by using a -1 pointer in decompose_rpath and other functions.\n\nChangelog:\n\t[BZ #22625]\n\t* elf/dl-load.c (fillin_rpath): Check for empty tokens before dynamic\n\tstring token expansion. Check for NULL pointer or empty string possibly\n\treturned by expand_dynamic_string_token.\n\t(decompose_rpath): Check for empty path after dynamic string\n\ttoken expansion.\n\n(cherry picked from commit 3e3c904daef69b8bf7d5cc07f793c9f07c3553ef)","distinct":false,"url":"https://api.github.com/repos/bminor/glibc/commits/21c5d14bfb4e08bee86f94fd815535d3be2c3869"},{"sha":"f87adbcaa47de2109e1c4561a2badf8aa82bc349","author":{"name":"Florian Weimer","email":"a228da394793d2e6e5b1b6a5525945d856f25556@redhat.com"},"message":"elf: Count components of the expanded path in _dl_init_path [BZ #22607]\n\n(cherry picked from commit 3ff3dfa5af313a6ea33f3393916f30eece4f0171)","distinct":false,"url":"https://api.github.com/repos/bminor/glibc/commits/f87adbcaa47de2109e1c4561a2badf8aa82bc349"},{"sha":"d9c54360ca92a92ee8ee587f15a3cfc64fe4cb37","author":{"name":"Florian Weimer","email":"a228da394793d2e6e5b1b6a5525945d856f25556@redhat.com"},"message":"<array_length.h>: New array_length and array_end macros\n\n(cherry picked from commit c94a5688fb1228a862b2d4a3f1239cdc0e3349e5)","distinct":false,"url":"https://api.github.com/repos/bminor/glibc/commits/d9c54360ca92a92ee8ee587f15a3cfc64fe4cb37"},{"sha":"c64d6bc3da8e61feab4117bcad53bd97e7a111cd","author":{"name":"Florian Weimer","email":"a228da394793d2e6e5b1b6a5525945d856f25556@redhat.com"},"message":"elf: Compute correct array size in _dl_init_paths [BZ #22606]\n\n(cherry picked from commit 8a0b17e48b83e933960dfeb8fa08b259f03f310e)","distinct":false,"url":"https://api.github.com/repos/bminor/glibc/commits/c64d6bc3da8e61feab4117bcad53bd97e7a111cd"},{"sha":"d2450a97c3df5527ea0fd49743bc354c979c185f","author":{"name":"Arjun Shankar","email":"1a59e0ce01eb1f3f09608f507589cca78519dd39@lostca.se"},"message":"Fix integer overflows in internal memalign and malloc functions [BZ #22343]\n\nWhen posix_memalign is called with an alignment less than MALLOC_ALIGNMENT\nand a requested size close to SIZE_MAX, it falls back to malloc code\n(because the alignment of a block returned by malloc is sufficient to\nsatisfy the call).  In this case, an integer overflow in _int_malloc leads\nto posix_memalign incorrectly returning successfully.\n\nUpon fixing this and writing a somewhat thorough regression test, it was\ndiscovered that when posix_memalign is called with an alignment larger than\nMALLOC_ALIGNMENT (so it uses _int_memalign instead) and a requested size\nclose to SIZE_MAX, a different integer overflow in _int_memalign leads to\nposix_memalign incorrectly returning successfully.\n\nBoth integer overflows affect other memory allocation functions that use\n_int_malloc (one affected malloc in x86) or _int_memalign as well.\n\nThis commit fixes both integer overflows.  In addition to this, it adds a\nregression test to guard against false successful allocations by the\nfollowing memory allocation functions when called with too-large allocation\nsizes and, where relevant, various valid alignments:\nmalloc, realloc, calloc, reallocarray, memalign, posix_memalign,\naligned_alloc, valloc, and pvalloc.\n\n(cherry picked from commit 8e448310d74b283c5cd02b9ed7fb997b47bf9b22)","distinct":false,"url":"https://api.github.com/repos/bminor/glibc/commits/d2450a97c3df5527ea0fd49743bc354c979c185f"},{"sha":"407ec876262f0e6f55635ea0783f1f4a6c5d127f","author":{"name":"Florian Weimer","email":"a228da394793d2e6e5b1b6a5525945d856f25556@redhat.com"},"message":"Add ChangeLog reference to bug 16750/CVE-2009-5064\n\n(cherry picked from commit 403143e1df85dadd374f304bd891be0cd7573e3b)","distinct":false,"url":"https://api.github.com/repos/bminor/glibc/commits/407ec876262f0e6f55635ea0783f1f4a6c5d127f"},{"sha":"436359fd41343c1db0616bd90e8a05bf188f237c","author":{"name":"Florian Weimer","email":"a228da394793d2e6e5b1b6a5525945d856f25556@redhat.com"},"message":"Record CVE-2018-6485 in ChangeLog and NEWS [BZ #22343]\n\n(cherry picked from commit 4590634fd65162568b9f52fb4beb60aa25da37f2)","distinct":false,"url":"https://api.github.com/repos/bminor/glibc/commits/436359fd41343c1db0616bd90e8a05bf188f237c"},{"sha":"017d97cd2ec0f626f8afb8c73ea3d612d8e844c3","author":{"name":"Florian Weimer","email":"a228da394793d2e6e5b1b6a5525945d856f25556@redhat.com"},"message":"Record CVE-2018-6551 in NEWS and ChangeLog [BZ #22774]\n\n(cherry picked from commit 71aa429b029fdb6f9e65d44050388b51eca460d6)","distinct":false,"url":"https://api.github.com/repos/bminor/glibc/commits/017d97cd2ec0f626f8afb8c73ea3d612d8e844c3"}]}
{"actor":{"display_login":"berenm"}}