diff options
Diffstat (limited to 'external/poky/meta/recipes-core/glibc/glibc/CVE-2019-6488.patch')
| -rw-r--r-- | external/poky/meta/recipes-core/glibc/glibc/CVE-2019-6488.patch | 274 |
1 files changed, 0 insertions, 274 deletions
diff --git a/external/poky/meta/recipes-core/glibc/glibc/CVE-2019-6488.patch b/external/poky/meta/recipes-core/glibc/glibc/CVE-2019-6488.patch deleted file mode 100644 index fa423754..00000000 --- a/external/poky/meta/recipes-core/glibc/glibc/CVE-2019-6488.patch +++ /dev/null @@ -1,274 +0,0 @@ -From 718016100d889a986c536b595bf6ec0d6ab4b90e Mon Sep 17 00:00:00 2001 -From: "H.J. Lu" <hjl.tools@gmail.com> -Date: Fri, 1 Feb 2019 12:17:09 -0800 -Subject: [PATCH] x86-64 memchr/wmemchr: Properly handle the length parameter - [BZ #24097] -Reply-To: muislam@microsoft.com - -On x32, the size_t parameter may be passed in the lower 32 bits of a -64-bit register with the non-zero upper 32 bits. The string/memory -functions written in assembly can only use the lower 32 bits of a -64-bit register as length or must clear the upper 32 bits before using -the full 64-bit register for length. - -This pach fixes memchr/wmemchr for x32. Tested on x86-64 and x32. On -x86-64, libc.so is the same with and withou the fix. - - [BZ #24097] - CVE-2019-6488 - * sysdeps/x86_64/memchr.S: Use RDX_LP for length. Clear the - upper 32 bits of RDX register. - * sysdeps/x86_64/multiarch/memchr-avx2.S: Likewise. - * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memchr and - tst-size_t-wmemchr. - * sysdeps/x86_64/x32/test-size_t.h: New file. - * sysdeps/x86_64/x32/tst-size_t-memchr.c: Likewise. - * sysdeps/x86_64/x32/tst-size_t-wmemchr.c: Likewise. - -(cherry picked from commit 97700a34f36721b11a754cf37a1cc40695ece1fd) - -CVE: CVE-2019-6488 - -Upstream-Status: Backport - -Signed-off-by: Muminul Islam <muislam@microsoft.com> ---- - NEWS | 1 - - sysdeps/x86_64/memchr.S | 10 ++-- - sysdeps/x86_64/multiarch/memchr-avx2.S | 8 ++- - sysdeps/x86_64/x32/Makefile | 8 +++ - sysdeps/x86_64/x32/test-size_t.h | 35 ++++++++++++ - sysdeps/x86_64/x32/tst-size_t-memchr.c | 72 +++++++++++++++++++++++++ - sysdeps/x86_64/x32/tst-size_t-wmemchr.c | 20 +++++++ - 7 files changed, 148 insertions(+), 6 deletions(-) - create mode 100644 sysdeps/x86_64/x32/test-size_t.h - create mode 100644 sysdeps/x86_64/x32/tst-size_t-memchr.c - create mode 100644 sysdeps/x86_64/x32/tst-size_t-wmemchr.c - -diff --git a/NEWS b/NEWS -index fd14941128..b158973a30 100644 ---- a/NEWS -+++ b/NEWS -@@ -17,7 +17,6 @@ The following bugs are resolved with this release: - [23606] Missing ENDBR32 in sysdeps/i386/start.S - [23679] gethostid: Missing NULL check for gethostbyname_r result - [23717] Fix stack overflow in stdlib/tst-setcontext9 -- - - Version 2.28 - -diff --git a/sysdeps/x86_64/memchr.S b/sysdeps/x86_64/memchr.S -index feef5d4f24..cb320257a2 100644 ---- a/sysdeps/x86_64/memchr.S -+++ b/sysdeps/x86_64/memchr.S -@@ -34,12 +34,16 @@ ENTRY(MEMCHR) - mov %edi, %ecx - - #ifdef USE_AS_WMEMCHR -- test %rdx, %rdx -+ test %RDX_LP, %RDX_LP - jz L(return_null) -- shl $2, %rdx -+ shl $2, %RDX_LP - #else -+# ifdef __ILP32__ -+ /* Clear the upper 32 bits. */ -+ movl %edx, %edx -+# endif - punpcklbw %xmm1, %xmm1 -- test %rdx, %rdx -+ test %RDX_LP, %RDX_LP - jz L(return_null) - punpcklbw %xmm1, %xmm1 - #endif -diff --git a/sysdeps/x86_64/multiarch/memchr-avx2.S b/sysdeps/x86_64/multiarch/memchr-avx2.S -index 5f5e772554..c81da19bf0 100644 ---- a/sysdeps/x86_64/multiarch/memchr-avx2.S -+++ b/sysdeps/x86_64/multiarch/memchr-avx2.S -@@ -40,16 +40,20 @@ - ENTRY (MEMCHR) - # ifndef USE_AS_RAWMEMCHR - /* Check for zero length. */ -- testq %rdx, %rdx -+ test %RDX_LP, %RDX_LP - jz L(null) - # endif - movl %edi, %ecx - /* Broadcast CHAR to YMM0. */ - vmovd %esi, %xmm0 - # ifdef USE_AS_WMEMCHR -- shl $2, %rdx -+ shl $2, %RDX_LP - vpbroadcastd %xmm0, %ymm0 - # else -+# ifdef __ILP32__ -+ /* Clear the upper 32 bits. */ -+ movl %edx, %edx -+# endif - vpbroadcastb %xmm0, %ymm0 - # endif - /* Check if we may cross page boundary with one vector load. */ -diff --git a/sysdeps/x86_64/x32/Makefile b/sysdeps/x86_64/x32/Makefile -index f2ebc24fb0..7d528889c6 100644 ---- a/sysdeps/x86_64/x32/Makefile -+++ b/sysdeps/x86_64/x32/Makefile -@@ -4,3 +4,11 @@ ifeq ($(subdir),math) - # 64-bit llround. Add -fno-builtin-lround to silence the compiler. - CFLAGS-s_llround.c += -fno-builtin-lround - endif -+ -+ifeq ($(subdir),string) -+tests += tst-size_t-memchr -+endif -+ -+ifeq ($(subdir),wcsmbs) -+tests += tst-size_t-wmemchr -+endif -diff --git a/sysdeps/x86_64/x32/test-size_t.h b/sysdeps/x86_64/x32/test-size_t.h -new file mode 100644 -index 0000000000..78a940863e ---- /dev/null -+++ b/sysdeps/x86_64/x32/test-size_t.h -@@ -0,0 +1,35 @@ -+/* Test string/memory functions with size_t in the lower 32 bits of -+ 64-bit register. -+ Copyright (C) 2019 Free Software Foundation, Inc. -+ This file is part of the GNU C Library. -+ -+ The GNU C Library is free software; you can redistribute it and/or -+ modify it under the terms of the GNU Lesser General Public -+ License as published by the Free Software Foundation; either -+ version 2.1 of the License, or (at your option) any later version. -+ -+ The GNU C Library is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ Lesser General Public License for more details. -+ -+ You should have received a copy of the GNU Lesser General Public -+ License along with the GNU C Library; if not, see -+ <http://www.gnu.org/licenses/>. */ -+ -+#define TEST_MAIN -+#include <string/test-string.h> -+ -+/* On x32, parameter_t may be passed in a 64-bit register with the LEN -+ field in the lower 32 bits. When the LEN field of 64-bit register -+ is passed to string/memory function as the size_t parameter, only -+ the lower 32 bits can be used. */ -+typedef struct -+{ -+ union -+ { -+ size_t len; -+ void (*fn) (void); -+ }; -+ void *p; -+} parameter_t; -diff --git a/sysdeps/x86_64/x32/tst-size_t-memchr.c b/sysdeps/x86_64/x32/tst-size_t-memchr.c -new file mode 100644 -index 0000000000..29a3daf102 ---- /dev/null -+++ b/sysdeps/x86_64/x32/tst-size_t-memchr.c -@@ -0,0 +1,72 @@ -+/* Test memchr with size_t in the lower 32 bits of 64-bit register. -+ Copyright (C) 2019 Free Software Foundation, Inc. -+ This file is part of the GNU C Library. -+ -+ The GNU C Library is free software; you can redistribute it and/or -+ modify it under the terms of the GNU Lesser General Public -+ License as published by the Free Software Foundation; either -+ version 2.1 of the License, or (at your option) any later version. -+ -+ The GNU C Library is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ Lesser General Public License for more details. -+ -+ You should have received a copy of the GNU Lesser General Public -+ License along with the GNU C Library; if not, see -+ <http://www.gnu.org/licenses/>. */ -+ -+#ifndef WIDE -+# define TEST_NAME "memchr" -+#else -+# define TEST_NAME "wmemchr" -+#endif /* WIDE */ -+#include "test-size_t.h" -+ -+#ifndef WIDE -+# define MEMCHR memchr -+# define CHAR char -+# define UCHAR unsigned char -+#else -+# include <wchar.h> -+# define MEMCHR wmemchr -+# define CHAR wchar_t -+# define UCHAR wchar_t -+#endif /* WIDE */ -+ -+IMPL (MEMCHR, 1) -+ -+typedef CHAR * (*proto_t) (const CHAR*, int, size_t); -+ -+static CHAR * -+__attribute__ ((noinline, noclone)) -+do_memchr (parameter_t a, parameter_t b) -+{ -+ return CALL (&b, a.p, (uintptr_t) b.p, a.len); -+} -+ -+static int -+test_main (void) -+{ -+ test_init (); -+ -+ parameter_t src = { { page_size / sizeof (CHAR) }, buf2 }; -+ parameter_t c = { { 0 }, (void *) (uintptr_t) 0x12 }; -+ -+ int ret = 0; -+ FOR_EACH_IMPL (impl, 0) -+ { -+ c.fn = impl->fn; -+ CHAR *res = do_memchr (src, c); -+ if (res) -+ { -+ error (0, 0, "Wrong result in function %s: %p != NULL", -+ impl->name, res); -+ ret = 1; -+ } -+ } -+ -+ return ret ? EXIT_FAILURE : EXIT_SUCCESS; -+} -+ -+#include <support/test-driver.c> -diff --git a/sysdeps/x86_64/x32/tst-size_t-wmemchr.c b/sysdeps/x86_64/x32/tst-size_t-wmemchr.c -new file mode 100644 -index 0000000000..877801d646 ---- /dev/null -+++ b/sysdeps/x86_64/x32/tst-size_t-wmemchr.c -@@ -0,0 +1,20 @@ -+/* Test wmemchr with size_t in the lower 32 bits of 64-bit register. -+ Copyright (C) 2019 Free Software Foundation, Inc. -+ This file is part of the GNU C Library. -+ -+ The GNU C Library is free software; you can redistribute it and/or -+ modify it under the terms of the GNU Lesser General Public -+ License as published by the Free Software Foundation; either -+ version 2.1 of the License, or (at your option) any later version. -+ -+ The GNU C Library is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ Lesser General Public License for more details. -+ -+ You should have received a copy of the GNU Lesser General Public -+ License along with the GNU C Library; if not, see -+ <http://www.gnu.org/licenses/>. */ -+ -+#define WIDE 1 -+#include "tst-size_t-memchr.c" --- -2.23.0 - |