FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=releng%2F13.3 2023-11-07T18:41:55Z 2023-11-07T18:41:55Z Ed Maste emaste@FreeBSD.org 2023-11-07T14:16:13Z urn:sha1:0b7939d725ba0ca903c5f8a3ca6d74347eb88690 Two additional stdio changes followed 86a16ada1ea6 and need to be reverted as part of the fflush fix. This reverts commit 6e13794fbe6e82c21365d0fd66769bf8b19c0197. This reverts commit bafaa70b6f9098d83d074968c8e6747ecec1e118. Fixes: d09a3bf72c0b ("fflush: correct buffer handling in __sflush") Reviewed by: markj Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D42491 (cherry picked from commit 4e0e01bf6511c28212d7dff94fe131a502e13026) (cherry picked from commit d2c65a1c948648f11342274029a3f18b90aa58d2) Approved by: so 2023-11-07T18:41:49Z Ed Maste emaste@FreeBSD.org 2023-11-07T15:00:35Z urn:sha1:59ec3ffdd7ce85f32ea833e8024f7bacd36d4e97 errno.h was added in 44cf1e5eb470, which has been reverted. Fixes: d09a3bf72c0b ("fflush: correct buffer handling in __sflush") Sponsored by: The FreeBSD Foundation (cherry picked from commit 418f026bd5a5084c1c4e2e91ad38051f6caa928c) (cherry picked from commit abe12d2f4ce31c3da0961b1b0a58df11f5a41e19) Approved by: so 2023-11-07T13:39:48Z Dag-Erling Smørgrav des@FreeBSD.org 2023-08-03T15:13:45Z urn:sha1:6cb5690b3495741e9ece6f42ba4a85732932aa83 This fixes CVE-2014-8611 correctly. The commit that purported to fix CVE-2014-8611 (805288c2f062) only hid it behind another bug. Two later commits, 86a16ada1ea6 and 44cf1e5eb470, attempted to address this new bug but mostly just confused the issue. This commit rolls back the three previous changes and fixes CVE-2014-8611 correctly. The key to understanding the bug (and the fix) is that `_w` has different meanings for different stream modes. If the stream is unbuffered, it is always zero. If the stream is fully buffered, it is the amount of space remaining in the buffer (equal to the buffer size when the buffer is empty and zero when the buffer is full). If the stream is line-buffered, it is a negative number reflecting the amount of data in the buffer (zero when the buffer is empty and negative buffer size when the buffer is full). At the heart of `fflush()`, we call the stream's write function in a loop, where `t` represents the return value from the last call and `n` the amount of data that remains to be written. When the write function fails, we need to move the unwritten data to the top of the buffer (unless nothing was written) and adjust `_p` (which points to the next free location in the buffer) and `_w` accordingly. These variables have already been set to the values they should have after a successful flush, so instead of adjusting them down to reflect what was written, we're adjusting them up to reflect what remains. The bug was that while `_p` was always adjusted, we only adjusted `_w` if the stream was fully buffered. The fix is to also adjust `_w` for line-buffered streams. Everything else is just noise. Fixes: 805288c2f062 Fixes: 86a16ada1ea6 Fixes: 44cf1e5eb470 Sponsored by: Klara, Inc. (cherry picked from commit d09a3bf72c0b5f1779c52269671872368c99f02a) (cherry picked from commit 92709431b14df6c0687446247ac57cfc189ee827) Approved by: so 2023-11-06T14:43:41Z Dag-Erling Smørgrav des@FreeBSD.org 2023-08-03T15:08:03Z urn:sha1:ccdd8337f9cbd7d34e2e95df1440dd5f7225d0b4 It is clearer to avoid reusing temporary variables for different purposes. Sponsored by: Klara, Inc. (cherry picked from commit 1f90b4edffe815aebb35e74b79e10593b31f6b75) (cherry picked from commit 1e99535be2ea9c0ef8bc57fc885e9c01fa95d2dd) 2023-09-25T13:49:25Z Ed Maste emaste@FreeBSD.org 2022-06-30T14:52:29Z urn:sha1:08f02c751b34990719f55692a5450eef357352c5 Sponsored by: The FreeBSD Foundation (cherry picked from commit 7fde0187cc443468561f0a30d589ff0cfe45eef5) (cherry picked from commit 560e22c8fe460e00d16e5268fe1fbb316ad81101) (cherry picked from commit 5b5fa75acff11d871d0c90045f8c1a58fed85365) 2023-09-08T10:15:58Z Dag-Erling Smørgrav des@FreeBSD.org 2023-09-01T20:56:17Z urn:sha1:1f4786b8848504ff1c30a87258275e24811b583a While here, also update a mention of ANSI C. Sponsored by: Klara, Inc. Reviewed by: kevans, markj Differential Revision: https://reviews.freebsd.org/D41686 (cherry picked from commit 5a57401e7106132b61b16e34365cebf52b773007) libc: Further nit in fopen(3) man page. Sponsored by: Klara, Inc. Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D41687 (cherry picked from commit c9f5889d05b5854be033849a4ff9985699071548) 2023-08-23T17:43:32Z Warner Losh imp@FreeBSD.org 2023-08-22T01:32:13Z urn:sha1:24115b70d6d614ed7ac5cfc4f51fa9d6cfe8b1b2 Remove /^\.\\"\s*\$FreeBSD\$$\n/ Similar commit in main: (cherry picked from commit b2c76c41be32) 2023-08-23T17:43:31Z Warner Losh imp@FreeBSD.org 2023-08-22T01:32:08Z urn:sha1:b144e70a3325e033163aa4e6e15d0446e245702d Remove /^\.\\"\n\.\\"\s*\$FreeBSD\$$\n/ Similar commit in main: (cherry picked from commit fa9896e082a1) 2023-08-23T17:43:30Z Warner Losh imp@FreeBSD.org 2023-08-22T01:32:01Z urn:sha1:023fc80ee38a117fa65b2ccb2abf8bdc7dbd6fd9 Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/ Similar commit in main: (cherry picked from commit d0b2dbfa0ecf) 2023-08-23T17:43:26Z Warner Losh imp@FreeBSD.org 2023-08-22T01:31:41Z urn:sha1:3d497e17ebd33fe0f58d773e35ab994d750258d6 Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/ Similar commit in main: (cherry picked from commit 1d386b48a555)