diff --git a/79244173353d95149ad1944f61cc6bd2e43bd7d4.patch b/79244173353d95149ad1944f61cc6bd2e43bd7d4.patch new file mode 100644 index 0000000..835922b --- /dev/null +++ b/79244173353d95149ad1944f61cc6bd2e43bd7d4.patch @@ -0,0 +1,43 @@ +From 79244173353d95149ad1944f61cc6bd2e43bd7d4 Mon Sep 17 00:00:00 2001 +From: ellie timoney +Date: Tue, 20 Feb 2018 13:17:39 +1100 +Subject: [PATCH] master: reject unix domain listen paths that are too long + +Fixes #2253 +--- + master/master.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/master/master.c b/master/master.c +index 325afd42f..a28731fd0 100644 +--- a/master/master.c ++++ b/master/master.c +@@ -496,6 +496,12 @@ static void service_create(struct service *s) + EX_SOFTWARE); + + if (s->listen[0] == '/') { /* unix socket */ ++ if (strlen(s->listen) >= sizeof(sunsock.sun_path)) { ++ syslog(LOG_ERR, "invalid listen '%s' (too long), disabling %s", ++ s->listen, s->name); ++ service_forget_exec(s); ++ return; ++ } + res0_is_local = 1; + res0 = (struct addrinfo *)xzmalloc(sizeof(struct addrinfo)); + res0->ai_flags = AI_PASSIVE; +@@ -513,7 +519,14 @@ static void service_create(struct service *s) + sunsock.sun_len = res0->ai_addrlen; + #endif + sunsock.sun_family = AF_UNIX; +- strcpy(sunsock.sun_path, s->listen); ++ ++ int r = snprintf(sunsock.sun_path, sizeof(sunsock.sun_path), "%s", s->listen); ++ if (r < 0 || (size_t) r >= sizeof(sunsock.sun_path)) { ++ /* belt and suspenders */ ++ fatal("Serious software bug found: " ++ "over-long listen path not detected earlier!", ++ EX_SOFTWARE); ++ } + unlink(s->listen); + } else { /* inet socket */ + char *port; diff --git a/cyrus-imapd.spec b/cyrus-imapd.spec index f296078..73d5e10 100644 --- a/cyrus-imapd.spec +++ b/cyrus-imapd.spec @@ -39,6 +39,9 @@ Patch3: patch-cyrus-default-configs # branch Patch4: https://github.com/cyrusimap/cyrus-imapd/commit/1966c22fc4249a1157a4d4c1224138ce78653514.patch +# gcc8 detects a strcpy overflow in master. +Patch5: https://github.com/elliefm/cyrus-imapd/commit/79244173353d95149ad1944f61cc6bd2e43bd7d4.patch + Source10: cyrus-imapd.logrotate Source11: cyrus-imapd.pam-config Source12: cyrus-imapd.sysconfig @@ -527,7 +530,7 @@ for i in ${tests[@]}; do exclude+=("!$i"); done %endif # Add -vvv for too much output -./testrunner.pl %{?_smp_mflags} --cleanup -f pretty ${exclude[@]} 2>&1 +./testrunner.pl %{?_smp_mflags} --cleanup -v -f pretty ${exclude[@]} 2>&1 %pre