Skip to content

Commit 6cd3118

Browse files
[AUTO-CHERRYPICK] unixODBC: Address HIGH CVE-2024-1013 - branch main (#8568)
Co-authored-by: Adit Jha <111916775+aditjha-msft@users.noreply.github.com>
1 parent 2bf08ea commit 6cd3118

2 files changed

Lines changed: 50 additions & 2 deletions

File tree

SPECS/unixODBC/CVE-2024-1013.patch

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
From 45f501e1be2db6b017cc242c79bfb9de32b332a1 Mon Sep 17 00:00:00 2001
2+
From: Florian Weimer <fweimer@redhat.com>
3+
Date: Mon, 29 Jan 2024 08:27:29 +0100
4+
Subject: [PATCH] PostgreSQL driver: Fix incompatible pointer-to-integer types
5+
6+
These result in out-of-bounds stack writes on 64-bit architectures
7+
(caller has 4 bytes, callee writes 8 bytes), and seem to have gone
8+
unnoticed on little-endian architectures (although big-endian
9+
architectures must be broken).
10+
11+
This change is required to avoid a build failure with GCC 14.
12+
---
13+
Drivers/Postgre7.1/info.c | 6 +++---
14+
1 file changed, 3 insertions(+), 3 deletions(-)
15+
16+
diff --git a/Drivers/Postgre7.1/info.c b/Drivers/Postgre7.1/info.c
17+
index 63ac91f..2216ecd 100644
18+
--- a/Drivers/Postgre7.1/info.c
19+
+++ b/Drivers/Postgre7.1/info.c
20+
@@ -1779,14 +1779,14 @@ char *table_name;
21+
char index_name[MAX_INFO_STRING];
22+
short fields_vector[8];
23+
char isunique[10], isclustered[10];
24+
-SDWORD index_name_len, fields_vector_len;
25+
+SQLLEN index_name_len, fields_vector_len;
26+
TupleNode *row;
27+
int i;
28+
HSTMT hcol_stmt;
29+
StatementClass *col_stmt, *indx_stmt;
30+
char column_name[MAX_INFO_STRING], relhasrules[MAX_INFO_STRING];
31+
char **column_names = 0;
32+
-Int4 column_name_len;
33+
+SQLLEN column_name_len;
34+
int total_columns = 0;
35+
char error = TRUE;
36+
ConnInfo *ci;
37+
@@ -2136,7 +2136,7 @@ HSTMT htbl_stmt;
38+
StatementClass *tbl_stmt;
39+
char tables_query[STD_STATEMENT_LEN];
40+
char attname[MAX_INFO_STRING];
41+
-SDWORD attname_len;
42+
+SQLLEN attname_len;
43+
char pktab[MAX_TABLE_LEN + 1];
44+
Int2 result_cols;

SPECS/unixODBC/unixODBC.spec

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
Summary: ODBC driver manager
22
Name: unixODBC
33
Version: 2.3.9
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: GPLv2+ AND LGPLv2+
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
88
Group: System Environment/Libraries
99
URL: http://www.unixodbc.org/
1010
Source0: http://www.unixodbc.org/%{name}-%{version}.tar.gz
11+
Patch0: CVE-2024-1013.patch
1112
BuildRequires: autoconf
1213
BuildRequires: automake
1314
BuildRequires: libtool
@@ -28,7 +29,7 @@ ODBC, you need to install this package.
2829

2930
%prep
3031

31-
%setup -q
32+
%autosetup -p1
3233

3334
%build
3435
./configure --prefix=%{_prefix} \
@@ -72,6 +73,9 @@ rm -rf %{buildroot}%{_datadir}/libtool
7273
%{_libdir}/pkgconfig
7374

7475
%changelog
76+
* Mon Mar 25 2024 Adit Jha <aditjha@microsoft.com> - 2.3.9-3
77+
- Adding upstream patch to address CVE-2024-1013.
78+
7579
* Thu May 26 2022 Evan Lee <evlee@microsoft.com> - 2.3.9-2
7680
- Require glibc-iconv as a runtime dependency for unixODBC.
7781

0 commit comments

Comments
 (0)