From: Armin Kuster <akuster808@gmail.com>
To: akuster@mvista.com, openembedded-core@lists.openembedded.org
Subject: [master][krogoth][PATCH 4/4] gcc: Security fix CVE-2016-4490
Date: Fri, 6 May 2016 00:11:57 -0700 [thread overview]
Message-ID: <1462518717-2629-4-git-send-email-akuster808@gmail.com> (raw)
In-Reply-To: <1462518717-2629-1-git-send-email-akuster808@gmail.com>
From: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
meta/recipes-devtools/gcc/gcc-5.3.inc | 1 +
.../gcc/gcc-5.3/CVE-2016-4490.patch | 270 +++++++++++++++++++++
2 files changed, 271 insertions(+)
create mode 100644 meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch
diff --git a/meta/recipes-devtools/gcc/gcc-5.3.inc b/meta/recipes-devtools/gcc/gcc-5.3.inc
index 5fede2a..445d003 100644
--- a/meta/recipes-devtools/gcc/gcc-5.3.inc
+++ b/meta/recipes-devtools/gcc/gcc-5.3.inc
@@ -91,6 +91,7 @@ SRC_URI = "\
file://CVE-2016-4488.patch \
file://CVE-2016-4489.patch \
file://CVE-2016-2226.patch \
+ file://CVE-2016-4490.patch \
"
BACKPORTS = ""
diff --git a/meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch b/meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch
new file mode 100644
index 0000000..4a9ed69
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch
@@ -0,0 +1,270 @@
+From 7d235b1b5ea35352c54957ef5530d9a02c46962f Mon Sep 17 00:00:00 2001
+From: bernds <bernds@138bc75d-0d04-0410-961f-82ee72b054a4>
+Date: Mon, 2 May 2016 17:06:40 +0000
+Subject: [PATCH] =?UTF-8?q?Demangler=20integer=20overflow=20fixes=20from?=
+ =?UTF-8?q?=20Marcel=20B=C3=B6hme.?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+ PR c++/70498
+ * cp-demangle.c: Parse numbers as integer instead of long to avoid
+ overflow after sanity checks. Include <limits.h> if available.
+ (INT_MAX): Define if necessary.
+ (d_make_template_param): Takes integer argument instead of long.
+ (d_make_function_param): Likewise.
+ (d_append_num): Likewise.
+ (d_identifier): Likewise.
+ (d_number): Parse as and return integer.
+ (d_compact_number): Handle overflow.
+ (d_source_name): Change variable type to integer for parsed number.
+ (d_java_resource): Likewise.
+ (d_special_name): Likewise.
+ (d_discriminator): Likewise.
+ (d_unnamed_type): Likewise.
+ * testsuite/demangle-expected: Add regression test cases.
+
+
+
+git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@235767 138bc75d-0d04-0410-961f-82ee72b054a4
+
+Upstream-Status: Backport
+
+CVE: CVE-2016-4490
+hand applied ChangeLog
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ libiberty/ChangeLog | 19 +++++++++++++
+ libiberty/cp-demangle.c | 52 ++++++++++++++++++++---------------
+ libiberty/testsuite/demangle-expected | 14 ++++++++--
+ 3 files changed, 61 insertions(+), 24 deletions(-)
+
+Index: gcc-5.3.0/libiberty/cp-demangle.c
+===================================================================
+--- gcc-5.3.0.orig/libiberty/cp-demangle.c
++++ gcc-5.3.0/libiberty/cp-demangle.c
+@@ -124,6 +124,13 @@ extern char *alloca ();
+ # endif /* alloca */
+ #endif /* HAVE_ALLOCA_H */
+
++#ifdef HAVE_LIMITS_H
++#include <limits.h>
++#endif
++#ifndef INT_MAX
++# define INT_MAX (int)(((unsigned int) ~0) >> 1) /* 0x7FFFFFFF */
++#endif
++
+ #include "ansidecl.h"
+ #include "libiberty.h"
+ #include "demangle.h"
+@@ -394,7 +401,7 @@ d_make_dtor (struct d_info *, enum gnu_v
+ struct demangle_component *);
+
+ static struct demangle_component *
+-d_make_template_param (struct d_info *, long);
++d_make_template_param (struct d_info *, int);
+
+ static struct demangle_component *
+ d_make_sub (struct d_info *, const char *, int);
+@@ -417,7 +424,7 @@ static struct demangle_component *d_unqu
+
+ static struct demangle_component *d_source_name (struct d_info *);
+
+-static long d_number (struct d_info *);
++static int d_number (struct d_info *);
+
+ static struct demangle_component *d_identifier (struct d_info *, int);
+
+@@ -1105,7 +1112,7 @@ d_make_dtor (struct d_info *di, enum gnu
+ /* Add a new template parameter. */
+
+ static struct demangle_component *
+-d_make_template_param (struct d_info *di, long i)
++d_make_template_param (struct d_info *di, int i)
+ {
+ struct demangle_component *p;
+
+@@ -1121,7 +1128,7 @@ d_make_template_param (struct d_info *di
+ /* Add a new function parameter. */
+
+ static struct demangle_component *
+-d_make_function_param (struct d_info *di, long i)
++d_make_function_param (struct d_info *di, int i)
+ {
+ struct demangle_component *p;
+
+@@ -1595,7 +1602,7 @@ d_unqualified_name (struct d_info *di)
+ static struct demangle_component *
+ d_source_name (struct d_info *di)
+ {
+- long len;
++ int len;
+ struct demangle_component *ret;
+
+ len = d_number (di);
+@@ -1608,12 +1615,12 @@ d_source_name (struct d_info *di)
+
+ /* number ::= [n] <(non-negative decimal integer)> */
+
+-static long
++static int
+ d_number (struct d_info *di)
+ {
+ int negative;
+ char peek;
+- long ret;
++ int ret;
+
+ negative = 0;
+ peek = d_peek_char (di);
+@@ -1840,7 +1847,7 @@ d_java_resource (struct d_info *di)
+ {
+ struct demangle_component *p = NULL;
+ struct demangle_component *next = NULL;
+- long len, i;
++ int len, i;
+ char c;
+ const char *str;
+
+@@ -1982,7 +1989,7 @@ d_special_name (struct d_info *di)
+ case 'C':
+ {
+ struct demangle_component *derived_type;
+- long offset;
++ int offset;
+ struct demangle_component *base_type;
+
+ derived_type = cplus_demangle_type (di);
+@@ -2905,10 +2912,10 @@ d_pointer_to_member_type (struct d_info
+
+ /* <non-negative number> _ */
+
+-static long
++static int
+ d_compact_number (struct d_info *di)
+ {
+- long num;
++ int num;
+ if (d_peek_char (di) == '_')
+ num = 0;
+ else if (d_peek_char (di) == 'n')
+@@ -2916,7 +2923,7 @@ d_compact_number (struct d_info *di)
+ else
+ num = d_number (di) + 1;
+
+- if (! d_check_char (di, '_'))
++ if (num < 0 || ! d_check_char (di, '_'))
+ return -1;
+ return num;
+ }
+@@ -2928,7 +2935,7 @@ d_compact_number (struct d_info *di)
+ static struct demangle_component *
+ d_template_param (struct d_info *di)
+ {
+- long param;
++ int param;
+
+ if (! d_check_char (di, 'T'))
+ return NULL;
+@@ -3130,9 +3137,10 @@ d_expression_1 (struct d_info *di)
+ }
+ else
+ {
+- index = d_compact_number (di) + 1;
+- if (index == 0)
++ index = d_compact_number (di);
++ if (index == INT_MAX || index == -1)
+ return NULL;
++ index ++;
+ }
+ return d_make_function_param (di, index);
+ }
+@@ -3455,7 +3463,7 @@ d_local_name (struct d_info *di)
+ static int
+ d_discriminator (struct d_info *di)
+ {
+- long discrim;
++ int discrim;
+
+ if (d_peek_char (di) != '_')
+ return 1;
+@@ -3511,7 +3519,7 @@ static struct demangle_component *
+ d_unnamed_type (struct d_info *di)
+ {
+ struct demangle_component *ret;
+- long num;
++ int num;
+
+ if (! d_check_char (di, 'U'))
+ return NULL;
+@@ -4037,10 +4045,10 @@ d_append_string (struct d_print_info *dp
+ }
+
+ static inline void
+-d_append_num (struct d_print_info *dpi, long l)
++d_append_num (struct d_print_info *dpi, int l)
+ {
+ char buf[25];
+- sprintf (buf,"%ld", l);
++ sprintf (buf,"%d", l);
+ d_append_string (dpi, buf);
+ }
+
+Index: gcc-5.3.0/libiberty/testsuite/demangle-expected
+===================================================================
+--- gcc-5.3.0.orig/libiberty/testsuite/demangle-expected
++++ gcc-5.3.0/libiberty/testsuite/demangle-expected
+@@ -4357,12 +4357,22 @@ _QueueNotification_QueueController__$4PP
+ _Z1fSsB3fooS_
+ f(std::string[abi:foo], std::string[abi:foo])
+ #
+-# Tests a use-after-free problem
++# Tests a use-after-free problem PR70481
+
+ _Q.__0
+ ::Q.(void)
+ #
+-# Tests a use-after-free problem
++# Tests a use-after-free problem PR70481
+
+ _Q10-__9cafebabe.
+ cafebabe.::-(void)
++#
++# Tests integer overflow problem PR70492
++
++__vt_90000000000cafebabe
++__vt_90000000000cafebabe
++#
++# Tests write access violation PR70498
++
++_Z80800000000000000000000
++_Z80800000000000000000000
+Index: gcc-5.3.0/libiberty/ChangeLog
+===================================================================
+--- gcc-5.3.0.orig/libiberty/ChangeLog
++++ gcc-5.3.0/libiberty/ChangeLog
+@@ -1,3 +1,22 @@
++2016-05-02 Marcel Böhme <boehme.marcel@gmail.com>
++
++ PR c++/70498
++ * cp-demangle.c: Parse numbers as integer instead of long to avoid
++ overflow after sanity checks. Include <limits.h> if available.
++ (INT_MAX): Define if necessary.
++ (d_make_template_param): Takes integer argument instead of long.
++ (d_make_function_param): Likewise.
++ (d_append_num): Likewise.
++ (d_identifier): Likewise.
++ (d_number): Parse as and return integer.
++ (d_compact_number): Handle overflow.
++ (d_source_name): Change variable type to integer for parsed number.
++ (d_java_resource): Likewise.
++ (d_special_name): Likewise.
++ (d_discriminator): Likewise.
++ (d_unnamed_type): Likewise.
++ * testsuite/demangle-expected: Add regression test cases.
++
+ 2016-04-08 Marcel Böhme <boehme.marcel@gmail.com>
+
+ PR c++/69687
--
2.3.5
next prev parent reply other threads:[~2016-05-06 7:12 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-06 7:11 [master][krogoth][PATCH 1/4] gcc: Security fix CVE-2016-4488 Armin Kuster
2016-05-06 7:11 ` [master][krogoth][PATCH 2/4] gcc: Security fix CVE-2016-4489 Armin Kuster
2016-05-06 7:11 ` [master][krogoth][PATCH 3/4] gcc: Security fix CVE-2016-2226 Armin Kuster
2016-05-13 16:14 ` akuster808
2016-05-06 7:11 ` Armin Kuster [this message]
2016-05-13 16:16 ` [master][krogoth][PATCH 4/4] gcc: Security fix CVE-2016-4490 akuster808
2016-05-13 18:07 ` Khem Raj
2016-05-13 20:52 ` akuster808
2016-05-13 21:04 ` Khem Raj
2016-05-14 3:26 ` akuster808
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1462518717-2629-4-git-send-email-akuster808@gmail.com \
--to=akuster808@gmail.com \
--cc=akuster@mvista.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.