new file mode 100644

@@ -0,0 +1,117 @@

+From f24c345bf5486cc8d659f7a17463adcae402ec8e Mon Sep 17 00:00:00 2001

+From: Aurelien Jarno <aurelien@aurel32.net>

+Date: Sat, 30 Dec 2017 10:54:23 +0100

+Subject: [PATCH] elf: Check for empty tokens before dynamic string token

+ expansion [BZ #22625]

+

+The fillin_rpath function in elf/dl-load.c loops over each RPATH or

+RUNPATH tokens and interprets empty tokens as the current directory

+("./"). In practice the check for empty token is done *after* the

+dynamic string token expansion. The expansion process can return an

+empty string for the $ORIGIN token if __libc_enable_secure is set

+or if the path of the binary can not be determined (/proc not mounted).

+

+Fix that by moving the check for empty tokens before the dynamic string

+token expansion. In addition, check for NULL pointer or empty strings

+return by expand_dynamic_string_token.

+

+The above changes highlighted a bug in decompose_rpath, an empty array

+is represented by the first element being NULL at the fillin_rpath

+level, but by using a -1 pointer in decompose_rpath and other functions.

+

+Changelog:

+	[BZ #22625]

+	* elf/dl-load.c (fillin_rpath): Check for empty tokens before dynamic

+	string token expansion. Check for NULL pointer or empty string possibly

+	returned by expand_dynamic_string_token.

+	(decompose_rpath): Check for empty path after dynamic string

+	token expansion.

+(cherry picked from commit 3e3c904daef69b8bf7d5cc07f793c9f07c3553ef)

+---

+ ChangeLog     | 10 ++++++++++

+ NEWS          |  4 ++++

+ elf/dl-load.c | 49 +++++++++++++++++++++++++++++++++----------------

+ 3 files changed, 47 insertions(+), 16 deletions(-)

+

+ The following bugs are resolved with this release:

+ 

+   [20790] Fix rpcgen buffer overrun

+diff --git a/elf/dl-load.c b/elf/dl-load.c

+index 75a1700..1f774e1 100644

+--- a/elf/dl-load.c

+@@ -434,31 +434,40 @@ fillin_rpath (char *rpath, struct r_search_path_elem **result, const char *sep,

+ {

+   char *cp;

+   size_t nelems = 0;

+-  char *to_free;

+ 

+   while ((cp = __strsep (&rpath, sep)) != NULL)

+     {

+       struct r_search_path_elem *dirp;

++      char *to_free = NULL;

++      size_t len = 0;

+ 

+-      to_free = cp = expand_dynamic_string_token (l, cp, 1);

++      /* `strsep' can pass an empty string.  */

++      if (*cp != '\0')

++	{

++	  to_free = cp = expand_dynamic_string_token (l, cp, 1);

+ 

+-      size_t len = strlen (cp);

++	  /* expand_dynamic_string_token can return NULL in case of empty

++	     path or memory allocation failure.  */

++	  if (cp == NULL)

++	    continue;

+ 

+-      /* `strsep' can pass an empty string.  This has to be

+-	 interpreted as `use the current directory'. */

+-      if (len == 0)

+-	{

+-	  static const char curwd[] = "./";

+-	  cp = (char *) curwd;

+-	}

++	  /* Compute the length after dynamic string token expansion and

++	     ignore empty paths.  */

++	  len = strlen (cp);

++	  if (len == 0)

++	    {

++	      free (to_free);

++	      continue;

++	    }

+ 

+-      /* Remove trailing slashes (except for "/").  */

+-      while (len > 1 && cp[len - 1] == '/')

+-	--len;

++	  /* Remove trailing slashes (except for "/").  */

++	  while (len > 1 && cp[len - 1] == '/')

++	    --len;

+ 

+-      /* Now add one if there is none so far.  */

+-      if (len > 0 && cp[len - 1] != '/')

+-	cp[len++] = '/';

++	  /* Now add one if there is none so far.  */

++	  if (len > 0 && cp[len - 1] != '/')

++	    cp[len++] = '/';

++	}

+ 

+       /* Make sure we don't use untrusted directories if we run SUID.  */

+       if (__glibc_unlikely (check_trusted) && !is_trusted_path (cp, len))

+@@ -622,6 +631,14 @@ decompose_rpath (struct r_search_path_struct *sps,

+      necessary.  */

+   free (copy);

+ 

++  /* There is no path after expansion.  */

++  if (result[0] == NULL)

++    {

++      free (result);

++      sps->dirs = (struct r_search_path_elem **) -1;

++      return false;

++    }

++

+   sps->dirs = result;

+   /* The caller will change this value if we haven't used a real malloc.  */

+   sps->malloced = 1;

+-- 

+2.9.3

+

@@ -6,7 +6,7 @@

 Summary:        Main C library

 Name:           glibc

 Version:        2.22

-Release:        17%{?dist}

+Release:        18%{?dist}

 License:        LGPLv2+

 URL:            http://www.gnu.org/software/libc

 Group:          Applications/System

@@ -45,6 +45,7 @@ Patch18:        glibc-fix-CVE-2017-15804.patch

 Patch19:        glibc-fix-CVE-2015-5180.patch

 #https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=patch;h=5e7fdabd7df1fc6c56d104e61390bf5a6b526c38

 Patch20:        glibc-2.22-CVE-2016-5417.patch

+Patch21:        glibc-fix-CVE-2017-16997.patch

 Provides:       rtld(GNU_HASH)

 Requires:       filesystem

 %description

@@ -91,6 +92,7 @@ sed -i 's/\\$$(pwd)/`pwd`/' timezone/Makefile

 %patch18 -p1

 %patch19 -p1

 %patch20 -p1

+%patch21 -p1

 install -vdm 755 %{_builddir}/%{name}-build

 # do not try to explicitly provide GLIBC_PRIVATE versioned libraries

 %define __find_provides %{_builddir}/%{name}-%{version}/find_provides.sh

@@ -217,6 +219,8 @@ popd

 %{_datarootdir}/locale/locale.alias

 %changelog

+*   Mon Jan 08 2018 Xiaolin Li <xiaolinl@vmware.com> 2.22-18

+-   Fix CVE-2017-16997

 *   Tue Dec 5 2017 Anish Swaminathan <anishs@vmware.com> 2.22-17

 -   Fix CVE-2016-5417

 *   Tue Nov 14 2017 Xiaolin Li <xiaolinl@vmware.com> 2.22-16