[AutoPR- Security] Patch ceph for CVE-2025-52939 (microsoft#14189)

Signed-off-by: Kanishk Bansal <[email protected]>
Co-authored-by: Kanishk Bansal <[email protected]>
Co-authored-by: jslobodzian <[email protected]>

Author: 3 people

SPECS/ceph/CVE-2025-52939.patch

@@ -0,0 +1,62 @@
+From 42d40581dd919fb134c07027ca1ce0844c670daf Mon Sep 17 00:00:00 2001
+From: Roberto Ierusalimschy <[email protected]>
+Date: Fri, 20 May 2022 13:14:33 -0300
+Subject: [PATCH] Save stack space while handling errors
+
+Because error handling (luaG_errormsg) uses slots from EXTRA_STACK,
+and some errors can recur (e.g., string overflow while creating an
+error message in 'luaG_runerror', or a C-stack overflow before calling
+the message handler), the code should use stack slots with parsimony.
+
+This commit fixes the bug "Lua-stack overflow when C stack overflows
+while handling an error".
+
+[AI Backported] Upstream Patch Reference: https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf
+
+---
+ ldebug.c | 5 ++++-
+ lvm.c    | 6 ++++--
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/civetweb/src/third_party/lua-5.3.3/src/ldebug.c b/src/civetweb/src/third_party/lua-5.3.3/src/ldebug.c
+index e499ee362..5ef7c62d1 100644
+--- a/src/civetweb/src/third_party/lua-5.3.3/src/ldebug.c
++++ b/src/civetweb/src/third_party/lua-5.3.3/src/ldebug.c
+@@ -637,8 +637,11 @@ l_noret luaG_runerror (lua_State *L, const char *fmt, ...) {
+   va_start(argp, fmt);
+   msg = luaO_pushvfstring(L, fmt, argp);  /* format message */
+   va_end(argp);
+-  if (isLua(ci))  /* if Lua function, add source:line information */
++  if (isLua(ci)) {  /* if Lua function, add source:line information */
+     luaG_addinfo(L, msg, ci_func(ci)->p->source, currentline(ci));
++    setobjs2s(L, L->top - 2, L->top - 1);  /* remove 'msg' from the stack */
++    L->top--;
++  }
+   luaG_errormsg(L);
+ }
+ 
+diff --git a/src/civetweb/src/third_party/lua-5.3.3/src/lvm.c b/src/civetweb/src/third_party/lua-5.3.3/src/lvm.c
+index 84ade6b2f..35d0b6af6 100644
+--- a/src/civetweb/src/third_party/lua-5.3.3/src/lvm.c
++++ b/src/civetweb/src/third_party/lua-5.3.3/src/lvm.c
+@@ -490,8 +490,10 @@ void luaV_concat (lua_State *L, int total) {
+       /* collect total length and number of strings */
+       for (n = 1; n < total && tostring(L, top - n - 1); n++) {
+         size_t l = vslen(top - n - 1);
+-        if (l >= (MAX_SIZE/sizeof(char)) - tl)
++        if (l >= (MAX_SIZE/sizeof(char)) - tl) {
++          L->top = top - total;  /* pop strings to avoid wasting stack */
+           luaG_runerror(L, "string length overflow");
++        }
+         tl += l;
+       }
+       if (tl <= LUAI_MAXSHORTLEN) {  /* is result a short string? */
+@@ -506,7 +508,7 @@ void luaV_concat (lua_State *L, int total) {
+       setsvalue2s(L, top - n, ts);  /* create result */
+     }
+     total -= n-1;  /* got 'n' strings to create 1 new */
+-    L->top -= n-1;  /* popped 'n' strings and pushed one */
++    L->top = top - (n - 1);  /* popped 'n' strings and pushed one */
+   } while (total > 1);  /* repeat until only 1 result left */
+ }
+ 

SPECS/ceph/ceph.spec

@@ -5,7 +5,7 @@
 Summary:        User space components of the Ceph file system
 Name:           ceph
 Version:        16.2.10
-Release:        7%{?dist}
+Release:        8%{?dist}
 License:        LGPLv2 and LGPLv3 and CC-BY-SA and GPLv2 and Boost and BSD and MIT and Public Domain and GPLv3 and ASL-2.0
 URL:            https://ceph.io/
 Vendor:         Microsoft Corporation
@@ -18,6 +18,7 @@ Patch3:         CVE-2022-3854.patch
 Patch4:         CVE-2023-43040.patch
 Patch5:         CVE-2024-38517.patch
 Patch6:		CVE-2025-1744.patch
+Patch7:         CVE-2025-52939.patch
 # 
 # Copyright (C) 2004-2019 The Ceph Project Developers. See COPYING file
 # at the top-level directory of this distribution and at
@@ -1813,6 +1814,9 @@ exit 0
 %config %{_sysconfdir}/prometheus/ceph/ceph_default_alerts.yml
 
 %changelog
+* Tue Jul 01 2025 Azure Linux Security Servicing Account <[email protected]> - 16.2.10-8
+- Patch for CVE-2025-52939
+
 * Tue Mar 11 2025 Kavya Sree Kaitepalli <[email protected]> - 16.2.10-7
 - Patch CVE-2025-1744
 * Sat Aug 24 2024 Jon Slobodzian <[email protected]> - 16.2.10-6