From: Armin Kuster <akuster808@gmail.com>
To: akuster@mvista.com, openembedded-core@lists.openembedded.org
Subject: [master][krogoth][PATCH 4/4] gcc: Security fix CVE-2016-4490
Date: Fri, 6 May 2016 00:11:57 -0700 [thread overview]
Message-ID: <1462518717-2629-4-git-send-email-akuster808@gmail.com> (raw)
In-Reply-To: <1462518717-2629-1-git-send-email-akuster808@gmail.com>
From: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
meta/recipes-devtools/gcc/gcc-5.3.inc | 1 +
.../gcc/gcc-5.3/CVE-2016-4490.patch | 270 +++++++++++++++++++++
2 files changed, 271 insertions(+)
create mode 100644 meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch
diff --git a/meta/recipes-devtools/gcc/gcc-5.3.inc b/meta/recipes-devtools/gcc/gcc-5.3.inc
index 5fede2a..445d003 100644
--- a/meta/recipes-devtools/gcc/gcc-5.3.inc
+++ b/meta/recipes-devtools/gcc/gcc-5.3.inc
@@ -91,6 +91,7 @@ SRC_URI = "\
file://CVE-2016-4488.patch \
file://CVE-2016-4489.patch \
file://CVE-2016-2226.patch \
+ file://CVE-2016-4490.patch \
"
BACKPORTS = ""
diff --git a/meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch b/meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch
new file mode 100644
index 0000000..4a9ed69
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc-5.3/CVE-2016-4490.patch
@@ -0,0 +1,270 @@
+From 7d235b1b5ea35352c54957ef5530d9a02c46962f Mon Sep 17 00:00:00 2001
+From: bernds <bernds@138bc75d-0d04-0410-961f-82ee72b054a4>
+Date: Mon, 2 May 2016 17:06:40 +0000
+Subject: [PATCH] =?UTF-8?q?Demangler=20integer=20overflow=20fixes=20from?=
+ =?UTF-8?q?=20Marcel=20B=C3=B6hme.?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+ PR c++/70498
+ * cp-demangle.c: Parse numbers as integer instead of long to avoid
+ overflow after sanity checks. Include <limits.h> if available.
+ (INT_MAX): Define if necessary.
+ (d_make_template_param): Takes integer argument instead of long.
+ (d_make_function_param): Likewise.
+ (d_append_num): Likewise.
+ (d_identifier): Likewise.
+ (d_number): Parse as and return integer.
+ (d_compact_number): Handle overflow.
+ (d_source_name): Change variable type to integer for parsed number.
+ (d_java_resource): Likewise.
+ (d_special_name): Likewise.
+ (d_discriminator): Likewise.
+ (d_unnamed_type): Likewise.
+ * testsuite/demangle-expected: Add regression test cases.
+
+
+
+git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@235767 138bc75d-0d04-0410-961f-82ee72b054a4
+
+Upstream-Status: Backport
+
+CVE: CVE-2016-4490
+hand applied ChangeLog
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ libiberty/ChangeLog | 19 +++++++++++++
+ libiberty/cp-demangle.c | 52 ++++++++++++++++++++---------------
+ libiberty/testsuite/demangle-expected | 14 ++++++++--
+ 3 files changed, 61 insertions(+), 24 deletions(-)
+
+Index: gcc-5.3.0/libiberty/cp-demangle.c
+===================================================================
+--- gcc-5.3.0.orig/libiberty/cp-demangle.c
++++ gcc-5.3.0/libiberty/cp-demangle.c
+@@ -124,6 +124,13 @@ extern char *alloca ();
+ # endif /* alloca */
+ #endif /* HAVE_ALLOCA_H */
+
++#ifdef HAVE_LIMITS_H
++#include <limits.h>
++#endif
++#ifndef INT_MAX
++# define INT_MAX (int)(((unsigned int) ~0) >> 1) /* 0x7FFFFFFF */
++#endif
++
+ #include "ansidecl.h"
+ #include "libiberty.h"
+ #include "demangle.h"
+@@ -394,7 +401,7 @@ d_make_dtor (struct d_info *, enum gnu_v
+ struct demangle_component *);
+
+ static struct demangle_component *
+-d_make_template_param (struct d_info *, long);
++d_make_template_param (struct d_info *, int);
+
+ static struct demangle_component *
+ d_make_sub (struct d_info *, const char *, int);
+@@ -417,7 +424,7 @@ static struct demangle_component *d_unqu
+
+ static struct demangle_component *d_source_name (struct d_info *);
+
+-static long d_number (struct d_info *);
++static int d_number (struct d_info *);
+
+ static struct demangle_component *d_identifier (struct d_info *, int);
+
+@@ -1105,7 +1112,7 @@ d_make_dtor (struct d_info *di, enum gnu
+ /* Add a new template parameter. */
+
+ static struct demangle_component *
+-d_make_template_param (struct d_info *di, long i)
++d_make_template_param (struct d_info *di, int i)
+ {
+ struct demangle_component *p;
+
+@@ -1121,7 +1128,7 @@ d_make_template_param (struct d_info *di
+ /* Add a new function parameter. */
+
+ static struct demangle_component *
+-d_make_function_param (struct d_info *di, long i)
++d_make_function_param (struct d_info *di, int i)
+ {
+ struct demangle_component *p;
+
+@@ -1595,7 +1602,7 @@ d_unqualified_name (struct d_info *di)
+ static struct demangle_component *
+ d_source_name (struct d_info *di)
+ {
+- long len;
++ int len;
+ struct demangle_component *ret;
+
+ len = d_number (di);
+@@ -1608,12 +1615,12 @@ d_source_name (struct d_info *di)
+
+ /* number ::= [n] <(non-negative decimal integer)> */
+
+-static long
++static int
+ d_number (struct d_info *di)
+ {
+ int negative;
+ char peek;
+- long ret;
++ int ret;
+
+ negative = 0;
+ peek = d_peek_char (di);
+@@ -1840,7 +1847,7 @@ d_java_resource (struct d_info *di)
+ {
+ struct demangle_component *p = NULL;
+ struct demangle_component *next = NULL;
+- long len, i;
++ int len, i;
+ char c;
+ const char *str;
+
+@@ -1982,7 +1989,7 @@ d_special_name (struct d_info *di)
+ case 'C':
+ {
+ struct demangle_component *derived_type;
+- long offset;
++ int offset;
+ struct demangle_component *base_type;
+
+ derived_type = cplus_demangle_type (di);
+@@ -2905,10 +2912,10 @@ d_pointer_to_member_type (struct d_info
+
+ /* <non-negative number> _ */
+
+-static long
++static int
+ d_compact_number (struct d_info *di)
+ {
+- long num;
++ int num;
+ if (d_peek_char (di) == '_')
+ num = 0;
+ else if (d_peek_char (di) == 'n')
+@@ -2916,7 +2923,7 @@ d_compact_number (struct d_info *di)
+ else
+ num = d_number (di) + 1;
+
+- if (! d_check_char (di, '_'))
++ if (num < 0 || ! d_check_char (di, '_'))
+ return -1;
+ return num;
+ }
+@@ -2928,7 +2935,7 @@ d_compact_number (struct d_info *di)
+ static struct demangle_component *
+ d_template_param (struct d_info *di)
+ {
+- long param;
++ int param;
+
+ if (! d_check_char (di, 'T'))
+ return NULL;
+@@ -3130,9 +3137,10 @@ d_expression_1 (struct d_info *di)
+ }
+ else
+ {
+- index = d_compact_number (di) + 1;
+- if (index == 0)
++ index = d_compact_number (di);
++ if (index == INT_MAX || index == -1)
+ return NULL;
++ index ++;
+ }
+ return d_make_function_param (di, index);
+ }
+@@ -3455,7 +3463,7 @@ d_local_name (struct d_info *di)
+ static int
+ d_discriminator (struct d_info *di)
+ {
+- long discrim;
++ int discrim;
+
+ if (d_peek_char (di) != '_')
+ return 1;
+@@ -3511,7 +3519,7 @@ static struct demangle_component *
+ d_unnamed_type (struct d_info *di)
+ {
+ struct demangle_component *ret;
+- long num;
++ int num;
+
+ if (! d_check_char (di, 'U'))
+ return NULL;
+@@ -4037,10 +4045,10 @@ d_append_string (struct d_print_info *dp
+ }
+
+ static inline void
+-d_append_num (struct d_print_info *dpi, long l)
++d_append_num (struct d_print_info *dpi, int l)
+ {
+ char buf[25];
+- sprintf (buf,"%ld", l);
++ sprintf (buf,"%d", l);
+ d_append_string (dpi, buf);
+ }
+
+Index: gcc-5.3.0/libiberty/testsuite/demangle-expected
+===================================================================
+--- gcc-5.3.0.orig/libiberty/testsuite/demangle-expected
++++ gcc-5.3.0/libiberty/testsuite/demangle-expected
+@@ -4357,12 +4357,22 @@ _QueueNotification_QueueController__$4PP
+ _Z1fSsB3fooS_
+ f(std::string[abi:foo], std::string[abi:foo])
+ #
+-# Tests a use-after-free problem
++# Tests a use-after-free problem PR70481
+
+ _Q.__0
+ ::Q.(void)
+ #
+-# Tests a use-after-free problem
++# Tests a use-after-free problem PR70481
+
+ _Q10-__9cafebabe.
+ cafebabe.::-(void)
++#
++# Tests integer overflow problem PR70492
++
++__vt_90000000000cafebabe
++__vt_90000000000cafebabe
++#
++# Tests write access violation PR70498
++
++_Z80800000000000000000000
++_Z80800000000000000000000
+Index: gcc-5.3.0/libiberty/ChangeLog
+===================================================================
+--- gcc-5.3.0.orig/libiberty/ChangeLog
++++ gcc-5.3.0/libiberty/ChangeLog
+@@ -1,3 +1,22 @@
++2016-05-02 Marcel Böhme <boehme.marcel@gmail.com>
++
++ PR c++/70498
++ * cp-demangle.c: Parse numbers as integer instead of long to avoid
++ overflow after sanity checks. Include <limits.h> if available.
++ (INT_MAX): Define if necessary.
++ (d_make_template_param): Takes integer argument instead of long.
++ (d_make_function_param): Likewise.
++ (d_append_num): Likewise.
++ (d_identifier): Likewise.
++ (d_number): Parse as and return integer.
++ (d_compact_number): Handle overflow.
++ (d_source_name): Change variable type to integer for parsed number.
++ (d_java_resource): Likewise.
++ (d_special_name): Likewise.
++ (d_discriminator): Likewise.
++ (d_unnamed_type): Likewise.
++ * testsuite/demangle-expected: Add regression test cases.
++
+ 2016-04-08 Marcel Böhme <boehme.marcel@gmail.com>
+
+ PR c++/69687
--
2.3.5
next prev parent reply other threads:[~2016-05-06 7:12 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-06 7:11 [master][krogoth][PATCH 1/4] gcc: Security fix CVE-2016-4488 Armin Kuster
2016-05-06 7:11 ` [master][krogoth][PATCH 2/4] gcc: Security fix CVE-2016-4489 Armin Kuster
2016-05-06 7:11 ` [master][krogoth][PATCH 3/4] gcc: Security fix CVE-2016-2226 Armin Kuster
2016-05-13 16:14 ` akuster808
2016-05-06 7:11 ` Armin Kuster [this message]
2016-05-13 16:16 ` [master][krogoth][PATCH 4/4] gcc: Security fix CVE-2016-4490 akuster808
2016-05-13 18:07 ` Khem Raj
2016-05-13 20:52 ` akuster808
2016-05-13 21:04 ` Khem Raj
2016-05-14 3:26 ` akuster808
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1462518717-2629-4-git-send-email-akuster808@gmail.com \
--to=akuster808@gmail.com \
--cc=akuster@mvista.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox