mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 00:20:38 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/augeas: add upstream security fix for CVE-2025-2588

Browse Source 
Fixes the following security issue:

- CVE-2025-2588: This vulnerability affects the function
    re_case_expand of the file src/fa.c. The manipulation of the
    argument re leads to null pointer dereference

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-2588
  - af2aa88ab3

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: add patch name in comment near _IGNORE_CVES]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Thomas Perale
2025-04-10 22:18:01 +02:00
committed by Julien Olivain
parent f2b14baf25
commit c497e5fcc7
2 changed files with 80 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

77
package/augeas/0001-CVE-2025-2588-return-_REG_ENOSYS-if-no-specific-error-was-set-yet-parse_regexp-failed.patch Normal file
View File

@@ -0,0 +1,77 @@
From af2aa88ab37fc48167d8c5e43b1770a4ba2ff403 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abbra@users.noreply.github.com>
Date: Sun, 30 Mar 2025 12:27:04 +0300
Subject: [PATCH] CVE-2025-2588: return _REG_ENOSYS if no specific error was
set yet parse_regexp failed (#854)
parse_regexp() supposed to set an error on the parser state in case of a
failure. If no specific error was set, return _REG_ENOSYS to indicate a
generic failure.
Fixes: https://github.com/hercules-team/augeas/issues/671
Fixes: https://github.com/hercules-team/augeas/issues/778
Fixes: https://github.com/hercules-team/augeas/issues/852
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Upstream: https://github.com/hercules-team/augeas/commit/af2aa88ab37fc48167d8c5e43b1770a4ba2ff403
CVE: CVE-2025-2588
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
src/fa.c | 2 ++
src/fa.h | 3 ++-
tests/fatest.c | 6 ++++++
3 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/src/fa.c b/src/fa.c
index 66ac70784..4de5675b9 100644
--- a/src/fa.c
+++ b/src/fa.c
@@ -3550,6 +3550,8 @@ static struct re *parse_regexp(struct re_parse *parse) {
return re;
error:
+ if (re == NULL && parse->error == REG_NOERROR)
+ parse->error = _REG_ENOSYS;
re_unref(re);
return NULL;
}
diff --git a/src/fa.h b/src/fa.h
index 1fd754ad0..89c9b17e9 100644
--- a/src/fa.h
+++ b/src/fa.h
@@ -81,7 +81,8 @@ extern int fa_minimization_algorithm;
*
* On success, FA points to the newly allocated automaton constructed for
* RE, and the function returns REG_NOERROR. Otherwise, FA is NULL, and the
- * return value indicates the error.
+ * return value indicates the error. Special value _REG_ENOSYS indicates
+ * fa_compile() couldn't identify the syntax issue with regexp.
*
* The FA is case sensitive. Call FA_NOCASE to switch it to
* case-insensitive.
diff --git a/tests/fatest.c b/tests/fatest.c
index 0c9ca7696..6717af8f4 100644
--- a/tests/fatest.c
+++ b/tests/fatest.c
@@ -589,6 +589,7 @@ static void testExpandNoCase(CuTest *tc) {
const char *p1 = "aB";
const char *p2 = "[a-cUV]";
const char *p3 = "[^a-z]";
+ const char *wrong_regexp = "{&.{";
char *s;
size_t len;
int r;
@@ -607,6 +608,11 @@ static void testExpandNoCase(CuTest *tc) {
CuAssertIntEquals(tc, 0, r);
CuAssertStrEquals(tc, "[^A-Za-z]", s);
free(s);
+
+ /* Test that fa_expand_nocase does return _REG_ENOSYS */
+ r = fa_expand_nocase(wrong_regexp, strlen(wrong_regexp), &s, &len);
+ CuAssertIntEquals(tc, _REG_ENOSYS, r);
+ free(s);
}
static void testNoCaseComplement(CuTest *tc) {

3
package/augeas/augeas.mk
View File

@@ -14,6 +14,9 @@ AUGEAS_DEPENDENCIES = host-pkgconf readline libxml2
AUGEAS_CONF_OPTS = --disable-gnulib-tests
# 0001-CVE-2025-2588-return-_REG_ENOSYS-if-no-specific-error-was-set-yet-parse_regexp-failed.patch
AUGEAS_IGNORE_CVES += CVE-2025-2588
# Remove the test lenses which occupy about 1.4 MB on the target
define AUGEAS_REMOVE_TEST_LENSES
rm -rf $(TARGET_DIR)/usr/share/augeas/lenses/dist/tests