new file mode 100644

@@ -0,0 +1,254 @@

+diff -rup systemd-228/src/basic/def.h systemd-228-1/src/basic/def.h

+--- systemd-228/src/basic/def.h	2015-11-17 23:59:06.000000000 -0800

+@@ -92,3 +92,5 @@

+         "/usr/local/lib/" n "\0" \

+         "/usr/lib/" n "\0" \

+         _CONF_PATHS_SPLIT_USR(n)

++

++#define LONG_LINE_MAX (1U*1024U*1024U)

+diff -rup systemd-228/src/basic/fileio.c systemd-228-1/src/basic/fileio.c

+--- systemd-228/src/basic/fileio.c	2015-11-17 23:59:06.000000000 -0800

+@@ -1240,3 +1240,75 @@ int read_timestamp_file(const char *fn,

+         *ret = (usec_t) t;

+         return 0;

+ }

++

++DEFINE_TRIVIAL_CLEANUP_FUNC(FILE*, funlockfile);

++

++int read_line(FILE *f, size_t limit, char **ret) {

++        _cleanup_free_ char *buffer = NULL;

++        size_t n = 0, allocated = 0, count = 0;

++

++        assert(f);

++

++        /* Something like a bounded version of getline().

++         *

++         * Considers EOF, \n and \0 end of line delimiters, and does not include these delimiters in the string

++         * returned.

++         *

++         * Returns the number of bytes read from the files (i.e. including delimiters — this hence usually differs from

++         * the number of characters in the returned string). When EOF is hit, 0 is returned.

++         *

++         * The input parameter limit is the maximum numbers of characters in the returned string, i.e. excluding

++         * delimiters. If the limit is hit we fail and return -ENOBUFS.

++         *

++         * If a line shall be skipped ret may be initialized as NULL. */

++

++        if (ret) {

++                if (!GREEDY_REALLOC(buffer, allocated, 1))

++                        return -ENOMEM;

++        }

++

++        {

++                _unused_ _cleanup_(funlockfilep) FILE *flocked = f;

++                flockfile(f);

++

++                for (;;) {

++                        int c;

++

++                        if (n >= limit)

++                                return -ENOBUFS;

++

++                        errno = 0;

++                        c = fgetc_unlocked(f);

++                        if (c == EOF) {

++                                /* if we read an error, and have no data to return, then propagate the error */

++                                if (ferror_unlocked(f) && n == 0)

++                                        return errno > 0 ? -errno : -EIO;

++

++                                break;

++                        }

++

++                        count++;

++

++                        if (IN_SET(c, '\n', 0)) /* Reached a delimiter */

++                                break;

++

++                        if (ret) {

++                                if (!GREEDY_REALLOC(buffer, allocated, n + 2))

++                                        return -ENOMEM;

++

++                                buffer[n] = (char) c;

++                        }

++

++                        n++;

++                }

++        }

++

++        if (ret) {

++                buffer[n] = 0;

++

++                *ret = buffer;

++                buffer = NULL;

++        }

++

++        return (int) count;

++}

+diff -rup systemd-228/src/basic/fileio.h systemd-228-1/src/basic/fileio.h

+--- systemd-228/src/basic/fileio.h	2015-11-17 23:59:06.000000000 -0800

+@@ -41,6 +41,7 @@ int write_string_stream(FILE *f, const c

+ int write_string_file(const char *fn, const char *line, WriteStringFileFlags flags);

+ 

+ int read_one_line_file(const char *fn, char **line);

++int read_line(FILE *f, size_t limit, char **ret);

+ int read_full_file(const char *fn, char **contents, size_t *size);

+ int read_full_stream(FILE *f, char **contents, size_t *size);

+ 

+diff -rup systemd-228/src/core/job.c systemd-228-1/src/core/job.c

+--- systemd-228/src/core/job.c	2015-11-17 23:59:06.000000000 -0800

+@@ -29,6 +29,7 @@

+ #include "dbus-job.h"

+ #include "dbus.h"

+ #include "escape.h"

++#include "fileio.h"

+ #include "job.h"

+ #include "log.h"

+ #include "macro.h"

+@@ -1000,23 +1001,25 @@ int job_serialize(Job *j, FILE *f, FDSet

+ }

+ 

+ int job_deserialize(Job *j, FILE *f, FDSet *fds) {

++        int r;

++

+         assert(j);

+ 

+         for (;;) {

+-                char line[LINE_MAX], *l, *v;

++                _cleanup_free_ char *line = NULL;

++                char *l, *v;

+                 size_t k;

+ 

+-                if (!fgets(line, sizeof(line), f)) {

+-                        if (feof(f))

+-                                return 0;

+-                        return -errno;

+-                }

++                r = read_line(f, LONG_LINE_MAX, &line);

++                if (r < 0)

++                        return log_error_errno(r, "Failed to read serialization line: %m");

++                if (r == 0)

++                        return 0;

+ 

+-                char_array_0(line);

+                 l = strstrip(line);

+ 

+                 /* End marker */

+-                if (l[0] == 0)

++                if (isempty(l))

+                         return 0;

+ 

+                 k = strcspn(l, "=");

+diff -rup systemd-228/src/core/manager.c systemd-228-1/src/core/manager.c

+--- systemd-228/src/core/manager.c	2015-11-17 23:59:06.000000000 -0800

+@@ -2335,21 +2335,19 @@ int manager_deserialize(Manager *m, FILE

+         m->n_reloading ++;

+ 

+         for (;;) {

+-                char line[LINE_MAX], *l;

+-

+-                if (!fgets(line, sizeof(line), f)) {

+-                        if (feof(f))

+-                                r = 0;

+-                        else

+-                                r = -errno;

++                _cleanup_free_ char *line = NULL;

++                 const char *l;

+ 

++                r = read_line(f, LONG_LINE_MAX, &line);

++                if (r < 0) {

++                        r = log_error_errno(r, "Failed to read serialization line: %m");

+                         goto finish;

+                 }

++                if (r == 0)

++                        break;

+ 

+-                char_array_0(line);

+                 l = strstrip(line);

+-

+-                if (l[0] == 0)

++                if (isempty(l)) /* end marker */

+                         break;

+ 

+                 if (startswith(l, "current-job-id=")) {

+@@ -2471,20 +2469,17 @@ int manager_deserialize(Manager *m, FILE

+         }

+ 

+         for (;;) {

++                _cleanup_free_ char *name = NULL;

+                 Unit *u;

+-                char name[UNIT_NAME_MAX+2];

+ 

+                 /* Start marker */

+-                if (!fgets(name, sizeof(name), f)) {

+-                        if (feof(f))

+-                                r = 0;

+-                        else

+-                                r = -errno;

+-

++                r = read_line(f, LONG_LINE_MAX, &name);

++                if (r < 0) {

++                        r = log_error_errno(r, "Failed to read serialization line: %m");

+                         goto finish;

+                 }

+-

+-                char_array_0(name);

++                if (r == 0)

++                        break;

+ 

+                 r = manager_load_unit(m, strstrip(name), NULL, NULL, &u);

+                 if (r < 0)

+@@ -2496,9 +2491,6 @@ int manager_deserialize(Manager *m, FILE

+         }

+ 

+ finish:

+-        if (ferror(f))

+-                r = -EIO;

+-

+         assert(m->n_reloading > 0);

+         m->n_reloading --;

+ 

+diff -rup systemd-228/src/core/unit.c systemd-228-1/src/core/unit.c

+--- systemd-228/src/core/unit.c	2015-11-17 23:59:06.000000000 -0800

+@@ -2678,20 +2678,19 @@ int unit_deserialize(Unit *u, FILE *f, F

+                 rt = (ExecRuntime**) ((uint8_t*) u + offset);

+ 

+         for (;;) {

+-                char line[LINE_MAX], *l, *v;

++                _cleanup_free_ char *line = NULL;

++                char *l, *v;

+                 size_t k;

+ 

+-                if (!fgets(line, sizeof(line), f)) {

+-                        if (feof(f))

+-                                return 0;

+-                        return -errno;

+-                }

++                r = read_line(f, LONG_LINE_MAX, &line);

++                if (r < 0)

++                        return log_error_errno(r, "Failed to read serialization line: %m");

++                if (r == 0) /* eof */

++                        break;

+ 

+-                char_array_0(line);

+                 l = strstrip(line);

+ 

+-                /* End marker */

+-                if (isempty(l))

++                if (isempty(l)) /* End marker */

+                         return 0;

+ 

+                 k = strcspn(l, "=");

+@@ -2838,6 +2837,7 @@ int unit_deserialize(Unit *u, FILE *f, F

+                                 log_unit_warning(u, "Failed to deserialize unit parameter '%s', ignoring.", l);

+                 }

+         }

++        return 0;

+ }

+ 

+ int unit_add_node_link(Unit *u, const char *what, bool wants, UnitDependency dep) {

@@ -1,7 +1,7 @@

 Summary:          Systemd-228

 Name:             systemd

 Version:          228

-Release:          48%{?dist}

+Release:          49%{?dist}

 License:          LGPLv2+ and GPLv2+ and MIT

 URL:              http://www.freedesktop.org/wiki/Software/systemd/

 Group:            System Environment/Security

@@ -47,6 +47,7 @@ Patch29:          systemd-228-CVE-2017-15908-dns-pkt-loop-fix.patch

 Patch30:          systemd-228-CVE-2017-18078.patch

 Patch31:          systemd-228-CVE-2018-1049.patch

 Patch32:          systemd-228-CVE-2018-15688.patch 

+Patch33:          systemd-228-CVE-2018-15686.patch 

 Requires:         Linux-PAM

 Requires:         libcap

 Requires:         xz

@@ -113,6 +114,7 @@ sed -i "s:blkid/::" $(grep -rl "blkid/blkid.h")

 %patch30 -p1

 %patch31 -p1

 %patch32 -p1

+%patch33 -p1

 sed -i "s#\#DefaultTasksMax=512#DefaultTasksMax=infinity#g" src/core/system.conf

 %build

@@ -253,6 +255,8 @@ rm -rf %{buildroot}/*

 %changelog

+*    Fri Jan 04 2019 Anish Swaminathan <anishs@vmware.com> 228-49

+-    Fix CVE-2018-15686

 *    Fri Nov 02 2018 Tapas Kundu <tkundu@vmware.com> 228-48

 -    Fix CVE-2018-15688

 *    Mon Jul 23 2018 Ankit Jain <ankitja@vmware.com>  228-47