sys-libs/glibc: fixed CVE-2025-0395
BUG=b/391824410
TEST=sudo emerge sys-libs/glibc
RELEASE_NOTE=Fixed CVE-2025-0395 in sys-libs/glibc.
cos-patch: security-high
Change-Id: I1e612fbe4a4a462b080049edab95c34afc2b6485
Reviewed-on: https://cos-review.googlesource.com/c/third_party/overlays/chromiumos-overlay/+/93161
Reviewed-by: Michael Kochera <kochera@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
diff --git a/sys-libs/glibc/files/local/glibc-2.33/0018-CVE-2025-0395.patch b/sys-libs/glibc/files/local/glibc-2.33/0018-CVE-2025-0395.patch
new file mode 100644
index 0000000..a8a43ac
--- /dev/null
+++ b/sys-libs/glibc/files/local/glibc-2.33/0018-CVE-2025-0395.patch
@@ -0,0 +1,67 @@
+From 8b5d4be762419c4f6176261c6fea40ac559b88dc Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Wed, 22 Jan 2025 17:22:02 +0100
+Subject: [PATCH] Fix underallocation of abort_msg_s struct (CVE-2025-0395)
+
+Include the space needed to store the length of the message itself, in
+addition to the message string. This resolves BZ #32582.
+
+Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
+Reviewed: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+(cherry picked from commit 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578)
+
+Conflict in sysdeps/posix/libc_fatal.c due to missing cleanup after
+backtrace removal.
+---
+ assert/assert.c | 4 +++-
+ sysdeps/posix/libc_fatal.c | 5 +++--
+ 3 files changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/assert/assert.c b/assert/assert.c
+index 133a183bc3..9e55eeb473 100644
+--- a/assert/assert.c
++++ b/assert/assert.c
+@@ -18,6 +18,7 @@
+ #include <assert.h>
+ #include <atomic.h>
+ #include <ldsodefs.h>
++#include <libc-pointer-arith.h>
+ #include <libintl.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+@@ -64,7 +65,8 @@ __assert_fail_base (const char *fmt, const char *assertion, const char *file,
+ (void) __fxprintf (NULL, "%s", str);
+ (void) fflush (stderr);
+
+- total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1);
++ total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1,
++ GLRO(dl_pagesize));
+ struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE,
+ MAP_ANON | MAP_PRIVATE, -1, 0);
+ if (__glibc_likely (buf != MAP_FAILED))
+diff --git a/sysdeps/posix/libc_fatal.c b/sysdeps/posix/libc_fatal.c
+index 2ee0010b8d..dfa0780514 100644
+--- a/sysdeps/posix/libc_fatal.c
++++ b/sysdeps/posix/libc_fatal.c
+@@ -20,6 +20,7 @@
+ #include <errno.h>
+ #include <fcntl.h>
+ #include <ldsodefs.h>
++#include <libc-pointer-arith.h>
+ #include <paths.h>
+ #include <stdarg.h>
+ #include <stdbool.h>
+@@ -125,8 +126,8 @@ __libc_message (enum __libc_message_action action, const char *fmt, ...)
+
+ if ((action & do_abort))
+ {
+- total = ((total + 1 + GLRO(dl_pagesize) - 1)
+- & ~(GLRO(dl_pagesize) - 1));
++ total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1,
++ GLRO(dl_pagesize));
+ struct abort_msg_s *buf = __mmap (NULL, total,
+ PROT_READ | PROT_WRITE,
+ MAP_ANON | MAP_PRIVATE, -1, 0);
+--
+2.43.5
+
diff --git a/sys-libs/glibc/glibc-2.33-r18.ebuild b/sys-libs/glibc/glibc-2.33-r19.ebuild
similarity index 100%
rename from sys-libs/glibc/glibc-2.33-r18.ebuild
rename to sys-libs/glibc/glibc-2.33-r19.ebuild