Skip to content

Commit 4f0ad92

Browse files
PawelWMSPawelWMS
authored
Patched CVE-2012-2677 in mysql. (#10891)
1 parent 8245797 commit 4f0ad92

2 files changed

Lines changed: 133 additions & 1 deletion

File tree

‎SPECS/mysql/CVE-2012-2677.patch‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
From 2d28e88f243997312e584e0190b72ee03cd59825 Mon Sep 17 00:00:00 2001
2+
From: Pawel Winogrodzki <pawelwi@microsoft.com>
3+
Date: Wed, 30 Oct 2024 13:41:03 -0700
4+
Subject: [PATCH] Patch for CVE-2012-2677.
5+
6+
Patch retrieved from Fedora's "boost-1.48.0-13.fc17" SRPM:
7+
https://rpm.pbone.net/results_srodzaj_2_search_boost-1.48.0-13.fc17.src.rpm.html
8+
9+
This is a modified version of the patch "boost-1.48.0-pool.patch"
10+
from the mentioned SRPM. Modifications:
11+
- Skipping addition of the "libs/pool/test/test_bug_6701.cpp" file.
12+
MySQL's embedded version of "boost" doesn't contain the "libs" directory.
13+
- Removal of trailing whitespaces in "boost/pool/pool.hpp"
14+
to avoid noisy build logs.
15+
16+
Bugzilla thread #828858:
17+
https://bugzilla.redhat.com/show_bug.cgi?id=828858
18+
---
19+
boost/boost_1_77_0/boost/pool/pool.hpp | 34 +++++++++++++++++++-------
20+
1 file changed, 25 insertions(+), 9 deletions(-)
21+
22+
diff --git a/boost/boost_1_77_0/boost/pool/pool.hpp b/boost/boost_1_77_0/boost/pool/pool.hpp
23+
index c47b11fa..62ddd3bc 100644
24+
--- a/boost/boost_1_77_0/boost/pool/pool.hpp
25+
+++ b/boost/boost_1_77_0/boost/pool/pool.hpp
26+
@@ -26,6 +26,8 @@
27+
28+
#include <boost/pool/poolfwd.hpp>
29+
30+
+// std::numeric_limits
31+
+#include <boost/limits.hpp>
32+
// boost::integer::static_lcm
33+
#include <boost/integer/common_factor_ct.hpp>
34+
// boost::simple_segregated_storage
35+
@@ -355,6 +357,15 @@ class pool: protected simple_segregated_storage < typename UserAllocator::size_t
36+
return s;
37+
}
38+
39+
+ size_type max_chunks() const
40+
+ { //! Calculated maximum number of memory chunks that can be allocated in a single call by this Pool.
41+
+ size_type partition_size = alloc_size();
42+
+ size_type POD_size = math::static_lcm<sizeof(size_type), sizeof(void *)>::value + sizeof(size_type);
43+
+ size_type max_chunks = (std::numeric_limits<size_type>::max() - POD_size) / alloc_size();
44+
+
45+
+ return max_chunks;
46+
+ }
47+
+
48+
static void * & nextof(void * const ptr)
49+
{ //! \returns Pointer dereferenced.
50+
//! (Provided and used for the sake of code readability :)
51+
@@ -375,6 +386,8 @@ class pool: protected simple_segregated_storage < typename UserAllocator::size_t
52+
//! the first time that object needs to allocate system memory.
53+
//! The default is 32. This parameter may not be 0.
54+
//! \param nmax_size is the maximum number of chunks to allocate in one block.
55+
+ set_next_size(nnext_size);
56+
+ set_max_size(nmax_size);
57+
}
58+
59+
~pool()
60+
@@ -398,8 +411,8 @@ class pool: protected simple_segregated_storage < typename UserAllocator::size_t
61+
}
62+
void set_next_size(const size_type nnext_size)
63+
{ //! Set number of chunks to request from the system the next time that object needs to allocate system memory. This value should never be set to 0.
64+
- //! \returns nnext_size.
65+
- next_size = start_size = nnext_size;
66+
+ BOOST_USING_STD_MIN();
67+
+ next_size = start_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(nnext_size, max_chunks());
68+
}
69+
size_type get_max_size() const
70+
{ //! \returns max_size.
71+
@@ -407,7 +420,8 @@ class pool: protected simple_segregated_storage < typename UserAllocator::size_t
72+
}
73+
void set_max_size(const size_type nmax_size)
74+
{ //! Set max_size.
75+
- max_size = nmax_size;
76+
+ BOOST_USING_STD_MIN();
77+
+ max_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(nmax_size, max_chunks());
78+
}
79+
size_type get_requested_size() const
80+
{ //! \returns the requested size passed into the constructor.
81+
@@ -708,9 +722,9 @@ void * pool<UserAllocator>::malloc_need_resize()
82+
83+
BOOST_USING_STD_MIN();
84+
if(!max_size)
85+
- next_size <<= 1;
86+
+ set_next_size(next_size << 1);
87+
else if( next_size*partition_size/requested_size < max_size)
88+
- next_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size*requested_size/ partition_size);
89+
+ set_next_size(min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size * requested_size / partition_size));
90+
91+
// initialize it,
92+
store().add_block(node.begin(), node.element_size(), partition_size);
93+
@@ -748,9 +762,9 @@ void * pool<UserAllocator>::ordered_malloc_need_resize()
94+
95+
BOOST_USING_STD_MIN();
96+
if(!max_size)
97+
- next_size <<= 1;
98+
+ set_next_size(next_size << 1);
99+
else if( next_size*partition_size/requested_size < max_size)
100+
- next_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size*requested_size/ partition_size);
101+
+ set_next_size(min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size * requested_size / partition_size));
102+
103+
// initialize it,
104+
// (we can use "add_block" here because we know that
105+
@@ -792,6 +806,8 @@ void * pool<UserAllocator>::ordered_malloc(const size_type n)
106+
{ //! Gets address of a chunk n, allocating new memory if not already available.
107+
//! \returns Address of chunk n if allocated ok.
108+
//! \returns 0 if not enough memory for n chunks.
109+
+ if (n > max_chunks())
110+
+ return 0;
111+
112+
const size_type partition_size = alloc_size();
113+
const size_type total_req_size = n * requested_size;
114+
@@ -840,9 +856,9 @@ void * pool<UserAllocator>::ordered_malloc(const size_type n)
115+
116+
BOOST_USING_STD_MIN();
117+
if(!max_size)
118+
- next_size <<= 1;
119+
+ set_next_size(next_size << 1);
120+
else if( next_size*partition_size/requested_size < max_size)
121+
- next_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size*requested_size/ partition_size);
122+
+ set_next_size(min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size * requested_size / partition_size));
123+
124+
// insert it into the list,
125+
// handle border case.
126+
--
127+
2.34.1
128+

‎SPECS/mysql/mysql.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Summary: MySQL.
44
Name: mysql
55
Version: 8.0.40
6-
Release: 3%{?dist}
6+
Release: 4%{?dist}
77
License: GPLv2 with exceptions AND LGPLv2 AND BSD
88
Vendor: Microsoft Corporation
99
Distribution: Azure Linux
@@ -14,6 +14,7 @@ Patch0: CVE-2012-5627.nopatch
1414
# AZL's OpenSSL builds with the "no-chacha" option making all ChaCha
1515
# ciphers unavailable.
1616
Patch1: fix-tests-for-unsupported-chacha-ciphers.patch
17+
Patch2: CVE-2012-2677.patch
1718
BuildRequires: cmake
1819
BuildRequires: libtirpc-devel
1920
BuildRequires: openssl-devel
@@ -107,6 +108,9 @@ sudo -u test make test || { cat Testing/Temporary/LastTest.log; false; }
107108
%{_libdir}/pkgconfig/mysqlclient.pc
108109

109110
%changelog
111+
* Tue Nov 12 2024 Pawel Winogrodzki <pawelwi@microsoft.com> - 8.0.40-4
112+
- Patched CVE-2012-2677.
113+
110114
* Tue Nov 05 2024 Pawel Winogrodzki <pawelwi@microsoft.com> - 8.0.40-3
111115
- Explicitly setting "WITH_CURL=none".
112116

0 commit comments

Comments
 (0)