Bug 2528364

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte.  If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_MAX, and buf[SIZE_MAX] is an out-of-bounds read. On a typical two's-complement 64-bit target the pointer arithmetic wraps modulo 2^64, so in practice this reads buf[-1] - one byte immediately before the stack buffer.