Merge ~ahasenack/ubuntu/+source/autofs:noble-autofs-segfault-2061667 into ubuntu/+source/autofs:ubuntu/devel

[Andreas Hasenack]

This fixes a segfault in autofs.

I prepared a PPA to see if it fixes it for him: https://launchpad.net/~ahasenack/+archive/ubuntu/autofs-segfault-2061667/+packages

DEP8 tests are running, but they didn't catch this. An extra option is needed, which can either be in /etc/auto.master (my reproducer), or added automatically depending on the running kernel, as far as I can tell.

Regardless, the reproducer is basically:

/etc/auto.master:
/- file,sun:/etc/auto.mp strictexpire

/etc/auto.mp:
/mp defaults :/dev/loop0

I used a a loop device instead of other mount point, set one up with losetup to test.

Then just starting automount is enough to show the segfault in noble.

I just sent the fix upstream (see DEP3 headers), and it's still too early for a response.

[Andreas Hasenack (ahasenack)]

DEP8 tests just finished:

Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-noble-ahasenack-autofs-segfault-2061667/?format=plain)
  autofs @ amd64:
    17.04.24 18:29:09 Log 🗒️ ✅ Triggers: autofs/5.1.9-1ubuntu4~ppa1

https://autopkgtest.ubuntu.com/results/autopkgtest-noble-ahasenack-autofs-segfault-2061667/noble/amd64/a/autofs/20240417_182909_dae21@/log.gz

[Andreas Hasenack (ahasenack)]

Got confirmation from the reporter in the bug that the ppa fixed the crash.

[Robie Basak (racb)]

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, racb
Uploaders: ahasenack, racb
MP auto-approved

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, uploaded:

Uploading autofs_5.1.9-1ubuntu4.dsc
Uploading autofs_5.1.9-1ubuntu4.debian.tar.xz
Uploading autofs_5.1.9-1ubuntu4_source.buildinfo
Uploading autofs_5.1.9-1ubuntu4_source.changes

diff --git a/debian/changelog b/debian/changelog
index a75d9e0..d91efee 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+autofs (5.1.9-1ubuntu4) noble; urgency=medium
+
+  * d/p/adjust-buffer-size-for-snprintf.patch: fix buffer size when
+    appending to a string (LP: #2061667)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 17 Apr 2024 11:47:05 -0300
+
 autofs (5.1.9-1ubuntu3) noble; urgency=medium
 
   * No-change rebuild for CVE-2024-3094
diff --git a/debian/patches/adjust-buffer-size-for-snprintf.patch b/debian/patches/adjust-buffer-size-for-snprintf.patch
new file mode 100644
index 0000000..af2bbe1
--- /dev/null
+++ b/debian/patches/adjust-buffer-size-for-snprintf.patch
@@ -0,0 +1,28 @@
+Description: Fix buffer size in snprinf() call
+Author: Andreas Hasenack <[e-mail]>
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/autofs/+bug/2061667
+Forwarded: https://lore.kernel.org/autofs/CANYNYEEpJabu=[e-mail]/T/#u
+Last-Update: 2024-04-17
+
+diff --git a/lib/mounts.c b/lib/mounts.c
+index 05f18dbc..f1c5795b 100644
+--- a/lib/mounts.c
++++ b/lib/mounts.c
+@@ -760,7 +760,7 @@ char *make_options_string(char *path, int pipefd,
+ 	/* maybe add ",strictexpire" */
+ 	if (flags & MOUNT_FLAG_STRICTEXPIRE) {
+ 		new = snprintf(options + len,
+-			       max_len, "%s", ",strictexpire");
++			       max_len - len, "%s", ",strictexpire");
+ 		if (new < 0)
+ 		       goto error_out;
+ 		len += new;
+@@ -774,7 +774,7 @@ char *make_options_string(char *path, int pipefd,
+ 	/* maybe add ",ignore" */
+ 	if (flags & MOUNT_FLAG_IGNORE) {
+ 		new = snprintf(options + len,
+-			       max_len, "%s", ",ignore");
++			       max_len - len, "%s", ",ignore");
+ 		if (new < 0)
+ 		       goto error_out;
+ 		len += new;
diff --git a/debian/patches/series b/debian/patches/series
index 6cd3624..673f615 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -12,3 +12,4 @@ spelling-error-fixes.patch
 fix-lookup-ldap-crash.patch
 fix-nfs4-mounts-in-auto-net.patch
 ntlm-crammd5-require-credentials.patch
+adjust-buffer-size-for-snprintf.patch