cirros-testvm/src-cirros/buildroot-2015.05/package/glibc/2.18-svnr23787/0003-CVE-2014-6040.patch

   1 Backport from https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=41488498b6
   2 See https://bugzilla.redhat.com/show_bug.cgi?id=1135841
   3
   4 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
   5
   6 diff -Nura eglibc-2.19.orig/libc/iconvdata/ibm1364.c eglibc-2.19/libc/iconvdata/ibm1364.c
   7 --- eglibc-2.19.orig/libc/iconvdata/ibm1364.c   2015-01-08 16:05:53.918823240 -0300
   8 +++ eglibc-2.19/libc/iconvdata/ibm1364.c        2015-01-08 16:06:02.781555143 -0300
   9 @@ -220,7 +220,8 @@
  10           ++rp2;                                                              \
  11                                                                               \
  12         uint32_t res;                                                         \
  13 -       if (__builtin_expect (ch < rp2->start, 0)                             \
  14 +       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
  15 +           || __builtin_expect (ch < rp2->start, 0)                          \
  16             || (res = DB_TO_UCS4[ch + rp2->idx],                              \
  17                 __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \
  18           {                                                                   \
  19 diff -Nura eglibc-2.19.orig/libc/iconvdata/ibm932.c eglibc-2.19/libc/iconvdata/ibm932.c
  20 --- eglibc-2.19.orig/libc/iconvdata/ibm932.c    2015-01-08 16:05:53.910818967 -0300
  21 +++ eglibc-2.19/libc/iconvdata/ibm932.c 2015-01-08 16:06:02.781555143 -0300
  22 @@ -73,11 +73,12 @@
  23           }                                                                   \
  24                                                                               \
  25         ch = (ch * 0x100) + inptr[1];                                         \
  26 +       /* ch was less than 0xfd.  */                                         \
  27 +       assert (ch < 0xfd00);                                                 \
  28         while (ch > rp2->end)                                                 \
  29           ++rp2;                                                              \
  30                                                                               \
  31 -       if (__builtin_expect (rp2 == NULL, 0)                                 \
  32 -           || __builtin_expect (ch < rp2->start, 0)                          \
  33 +       if (__builtin_expect (ch < rp2->start, 0)                             \
  34             || (res = __ibm932db_to_ucs4[ch + rp2->idx],                      \
  35             __builtin_expect (res, '\1') == 0 && ch !=0))                     \
  36           {                                                                   \
  37 diff -Nura eglibc-2.19.orig/libc/iconvdata/ibm933.c eglibc-2.19/libc/iconvdata/ibm933.c
  38 --- eglibc-2.19.orig/libc/iconvdata/ibm933.c    2015-01-08 16:05:53.917822706 -0300
  39 +++ eglibc-2.19/libc/iconvdata/ibm933.c 2015-01-08 16:06:02.781555143 -0300
  40 @@ -161,7 +161,7 @@
  41         while (ch > rp2->end)                                                 \
  42           ++rp2;                                                              \
  43                                                                               \
  44 -       if (__builtin_expect (rp2 == NULL, 0)                                 \
  45 +       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
  46             || __builtin_expect (ch < rp2->start, 0)                          \
  47             || (res = __ibm933db_to_ucs4[ch + rp2->idx],                      \
  48                 __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \
  49 diff -Nura eglibc-2.19.orig/libc/iconvdata/ibm935.c eglibc-2.19/libc/iconvdata/ibm935.c
  50 --- eglibc-2.19.orig/libc/iconvdata/ibm935.c    2015-01-08 16:05:53.921824843 -0300
  51 +++ eglibc-2.19/libc/iconvdata/ibm935.c 2015-01-08 16:06:02.782555677 -0300
  52 @@ -161,7 +161,7 @@
  53         while (ch > rp2->end)                                                 \
  54           ++rp2;                                                              \
  55                                                                               \
  56 -       if (__builtin_expect (rp2 == NULL, 0)                                 \
  57 +       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
  58             || __builtin_expect (ch < rp2->start, 0)                          \
  59             || (res = __ibm935db_to_ucs4[ch + rp2->idx],                      \
  60                 __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \
  61 diff -Nura eglibc-2.19.orig/libc/iconvdata/ibm937.c eglibc-2.19/libc/iconvdata/ibm937.c
  62 --- eglibc-2.19.orig/libc/iconvdata/ibm937.c    2015-01-08 16:05:53.915821638 -0300
  63 +++ eglibc-2.19/libc/iconvdata/ibm937.c 2015-01-08 16:06:02.782555677 -0300
  64 @@ -161,7 +161,7 @@
  65         while (ch > rp2->end)                                                 \
  66           ++rp2;                                                              \
  67                                                                               \
  68 -       if (__builtin_expect (rp2 == NULL, 0)                                 \
  69 +       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
  70             || __builtin_expect (ch < rp2->start, 0)                          \
  71             || (res = __ibm937db_to_ucs4[ch + rp2->idx],                      \
  72                 __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \
  73 diff -Nura eglibc-2.19.orig/libc/iconvdata/ibm939.c eglibc-2.19/libc/iconvdata/ibm939.c
  74 --- eglibc-2.19.orig/libc/iconvdata/ibm939.c    2015-01-08 16:05:53.917822706 -0300
  75 +++ eglibc-2.19/libc/iconvdata/ibm939.c 2015-01-08 16:06:02.782555677 -0300
  76 @@ -161,7 +161,7 @@
  77         while (ch > rp2->end)                                                 \
  78           ++rp2;                                                              \
  79                                                                               \
  80 -       if (__builtin_expect (rp2 == NULL, 0)                                 \
  81 +       if (__builtin_expect (rp2->start == 0xffff, 0)                        \
  82             || __builtin_expect (ch < rp2->start, 0)                          \
  83             || (res = __ibm939db_to_ucs4[ch + rp2->idx],                      \
  84                 __builtin_expect (res, L'\1') == L'\0' && ch != '\0'))        \
  85 diff -Nura eglibc-2.19.orig/libc/iconvdata/ibm943.c eglibc-2.19/libc/iconvdata/ibm943.c
  86 --- eglibc-2.19.orig/libc/iconvdata/ibm943.c    2015-01-08 16:05:53.918823240 -0300
  87 +++ eglibc-2.19/libc/iconvdata/ibm943.c 2015-01-08 16:06:02.782555677 -0300
  88 @@ -74,11 +74,12 @@
  89           }                                                                   \
  90                                                                               \
  91         ch = (ch * 0x100) + inptr[1];                                         \
  92 +       /* ch was less than 0xfd.  */                                         \
  93 +       assert (ch < 0xfd00);                                                 \
  94         while (ch > rp2->end)                                                 \
  95           ++rp2;                                                              \
  96                                                                               \
  97 -       if (__builtin_expect (rp2 == NULL, 0)                                 \
  98 -           || __builtin_expect (ch < rp2->start, 0)                          \
  99 +       if (__builtin_expect (ch < rp2->start, 0)                             \
 100             || (res = __ibm943db_to_ucs4[ch + rp2->idx],                      \
 101             __builtin_expect (res, '\1') == 0 && ch !=0))                     \
 102           {                                                                   \
 103 diff -Nura eglibc-2.19.orig/libc/iconvdata/Makefile eglibc-2.19/libc/iconvdata/Makefile
 104 --- eglibc-2.19.orig/libc/iconvdata/Makefile    2015-01-08 16:05:53.903815227 -0300
 105 +++ eglibc-2.19/libc/iconvdata/Makefile 2015-01-08 16:06:02.782555677 -0300
 106 @@ -303,6 +303,7 @@
 107  $(objpfx)iconv-test.out: run-iconv-test.sh $(objpfx)gconv-modules \
 108                          $(addprefix $(objpfx),$(modules.so)) \
 109                          $(common-objdir)/iconv/iconv_prog TESTS
 110 +       iconv_modules="$(modules)" \
 111         $(SHELL) $< $(common-objdir) '$(test-wrapper)' > $@
 112
 113  $(objpfx)tst-tables.out: tst-tables.sh $(objpfx)gconv-modules \
 114 diff -Nura eglibc-2.19.orig/libc/iconvdata/run-iconv-test.sh eglibc-2.19/libc/iconvdata/run-iconv-test.sh
 115 --- eglibc-2.19.orig/libc/iconvdata/run-iconv-test.sh   2015-01-08 16:05:53.894810420 -0300
 116 +++ eglibc-2.19/libc/iconvdata/run-iconv-test.sh        2015-01-08 16:06:02.782555677 -0300
 117 @@ -188,6 +188,24 @@
 118
 119  done < TESTS2
 120
 121 +# Check for crashes in decoders.
 122 +printf '\016\377\377\377\377\377\377\377' > $temp1
 123 +for from in $iconv_modules ; do
 124 +    echo $ac_n "test decoder $from $ac_c"
 125 +    PROG=`eval echo $ICONV`
 126 +    if $PROG < $temp1 >/dev/null 2>&1 ; then
 127 +       : # fall through
 128 +    else
 129 +       status=$?
 130 +       if test $status -gt 1 ; then
 131 +           echo "/FAILED"
 132 +           failed=1
 133 +           continue
 134 +       fi
 135 +    fi
 136 +    echo "OK"
 137 +done
 138 +
 139  exit $failed
 140  # Local Variables:
 141  #  mode:shell-script