diff options
author | Jussi Kukkonen <jussi.kukkonen@intel.com> | 2017-03-16 11:15:35 +0200 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2017-03-16 22:11:32 +0000 |
commit | f3d8addbef5059d1972218d606b65bed0136517d (patch) | |
tree | 33944daeecfc0308a19448fcdfb09065834f5027 /meta/recipes-devtools/gcc | |
parent | 7f60b7c4746071149a27ae98d7df04a086d7caf8 (diff) | |
download | poky-f3d8addbef5059d1972218d606b65bed0136517d.tar.gz |
gcc: Remove unused patch
CVE-2016-4490 applied to gcc < 6.1.1, our version is 6.3
(From OE-Core rev: d8329861bf6f48f6e541a04062b8d1f373dfcd78)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/gcc')
-rw-r--r-- | meta/recipes-devtools/gcc/gcc-6.3/CVE-2016-4490.patch | 290 |
1 files changed, 0 insertions, 290 deletions
diff --git a/meta/recipes-devtools/gcc/gcc-6.3/CVE-2016-4490.patch b/meta/recipes-devtools/gcc/gcc-6.3/CVE-2016-4490.patch deleted file mode 100644 index f32e91d4fc..0000000000 --- a/meta/recipes-devtools/gcc/gcc-6.3/CVE-2016-4490.patch +++ /dev/null | |||
@@ -1,290 +0,0 @@ | |||
1 | From 7d235b1b5ea35352c54957ef5530d9a02c46962f Mon Sep 17 00:00:00 2001 | ||
2 | From: bernds <bernds@138bc75d-0d04-0410-961f-82ee72b054a4> | ||
3 | Date: Mon, 2 May 2016 17:06:40 +0000 | ||
4 | Subject: [PATCH] =?UTF-8?q?Demangler=20integer=20overflow=20fixes=20from?= | ||
5 | =?UTF-8?q?=20Marcel=20B=C3=B6hme.?= | ||
6 | MIME-Version: 1.0 | ||
7 | Content-Type: text/plain; charset=UTF-8 | ||
8 | Content-Transfer-Encoding: 8bit | ||
9 | |||
10 | PR c++/70498 | ||
11 | * cp-demangle.c: Parse numbers as integer instead of long to avoid | ||
12 | overflow after sanity checks. Include <limits.h> if available. | ||
13 | (INT_MAX): Define if necessary. | ||
14 | (d_make_template_param): Takes integer argument instead of long. | ||
15 | (d_make_function_param): Likewise. | ||
16 | (d_append_num): Likewise. | ||
17 | (d_identifier): Likewise. | ||
18 | (d_number): Parse as and return integer. | ||
19 | (d_compact_number): Handle overflow. | ||
20 | (d_source_name): Change variable type to integer for parsed number. | ||
21 | (d_java_resource): Likewise. | ||
22 | (d_special_name): Likewise. | ||
23 | (d_discriminator): Likewise. | ||
24 | (d_unnamed_type): Likewise. | ||
25 | * testsuite/demangle-expected: Add regression test cases. | ||
26 | |||
27 | |||
28 | |||
29 | git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@235767 138bc75d-0d04-0410-961f-82ee72b054a4 | ||
30 | |||
31 | Upstream-Status: Backport | ||
32 | CVE: CVE-2016-4490 | ||
33 | [Yocto #9632] | ||
34 | |||
35 | Signed-off-by: Armin Kuster <akuster@mvista.com> | ||
36 | |||
37 | --- | ||
38 | libiberty/ChangeLog | 19 +++++++++++++ | ||
39 | libiberty/cp-demangle.c | 52 ++++++++++++++++++++--------------- | ||
40 | libiberty/testsuite/demangle-expected | 14 ++++++++-- | ||
41 | 3 files changed, 61 insertions(+), 24 deletions(-) | ||
42 | |||
43 | Index: git/libiberty/ChangeLog | ||
44 | =================================================================== | ||
45 | --- git.orig/libiberty/ChangeLog | ||
46 | +++ git/libiberty/ChangeLog | ||
47 | @@ -1,3 +1,22 @@ | ||
48 | +2016-05-02 Marcel Böhme <boehme.marcel@gmail.com> | ||
49 | + | ||
50 | + PR c++/70498 | ||
51 | + * cp-demangle.c: Parse numbers as integer instead of long to avoid | ||
52 | + overflow after sanity checks. Include <limits.h> if available. | ||
53 | + (INT_MAX): Define if necessary. | ||
54 | + (d_make_template_param): Takes integer argument instead of long. | ||
55 | + (d_make_function_param): Likewise. | ||
56 | + (d_append_num): Likewise. | ||
57 | + (d_identifier): Likewise. | ||
58 | + (d_number): Parse as and return integer. | ||
59 | + (d_compact_number): Handle overflow. | ||
60 | + (d_source_name): Change variable type to integer for parsed number. | ||
61 | + (d_java_resource): Likewise. | ||
62 | + (d_special_name): Likewise. | ||
63 | + (d_discriminator): Likewise. | ||
64 | + (d_unnamed_type): Likewise. | ||
65 | + * testsuite/demangle-expected: Add regression test cases. | ||
66 | + | ||
67 | 2016-04-27 Release Manager | ||
68 | |||
69 | * GCC 6.1.0 released. | ||
70 | Index: git/libiberty/cp-demangle.c | ||
71 | =================================================================== | ||
72 | --- git.orig/libiberty/cp-demangle.c | ||
73 | +++ git/libiberty/cp-demangle.c | ||
74 | @@ -128,6 +128,13 @@ extern char *alloca (); | ||
75 | # endif /* alloca */ | ||
76 | #endif /* HAVE_ALLOCA_H */ | ||
77 | |||
78 | +#ifdef HAVE_LIMITS_H | ||
79 | +#include <limits.h> | ||
80 | +#endif | ||
81 | +#ifndef INT_MAX | ||
82 | +# define INT_MAX (int)(((unsigned int) ~0) >> 1) /* 0x7FFFFFFF */ | ||
83 | +#endif | ||
84 | + | ||
85 | #include "ansidecl.h" | ||
86 | #include "libiberty.h" | ||
87 | #include "demangle.h" | ||
88 | @@ -398,7 +405,7 @@ d_make_dtor (struct d_info *, enum gnu_v | ||
89 | struct demangle_component *); | ||
90 | |||
91 | static struct demangle_component * | ||
92 | -d_make_template_param (struct d_info *, long); | ||
93 | +d_make_template_param (struct d_info *, int); | ||
94 | |||
95 | static struct demangle_component * | ||
96 | d_make_sub (struct d_info *, const char *, int); | ||
97 | @@ -421,9 +428,9 @@ static struct demangle_component *d_unqu | ||
98 | |||
99 | static struct demangle_component *d_source_name (struct d_info *); | ||
100 | |||
101 | -static long d_number (struct d_info *); | ||
102 | +static int d_number (struct d_info *); | ||
103 | |||
104 | -static struct demangle_component *d_identifier (struct d_info *, long); | ||
105 | +static struct demangle_component *d_identifier (struct d_info *, int); | ||
106 | |||
107 | static struct demangle_component *d_operator_name (struct d_info *); | ||
108 | |||
109 | @@ -1119,7 +1126,7 @@ d_make_dtor (struct d_info *di, enum gnu | ||
110 | /* Add a new template parameter. */ | ||
111 | |||
112 | static struct demangle_component * | ||
113 | -d_make_template_param (struct d_info *di, long i) | ||
114 | +d_make_template_param (struct d_info *di, int i) | ||
115 | { | ||
116 | struct demangle_component *p; | ||
117 | |||
118 | @@ -1135,7 +1142,7 @@ d_make_template_param (struct d_info *di | ||
119 | /* Add a new function parameter. */ | ||
120 | |||
121 | static struct demangle_component * | ||
122 | -d_make_function_param (struct d_info *di, long i) | ||
123 | +d_make_function_param (struct d_info *di, int i) | ||
124 | { | ||
125 | struct demangle_component *p; | ||
126 | |||
127 | @@ -1620,7 +1627,7 @@ d_unqualified_name (struct d_info *di) | ||
128 | static struct demangle_component * | ||
129 | d_source_name (struct d_info *di) | ||
130 | { | ||
131 | - long len; | ||
132 | + int len; | ||
133 | struct demangle_component *ret; | ||
134 | |||
135 | len = d_number (di); | ||
136 | @@ -1633,12 +1640,12 @@ d_source_name (struct d_info *di) | ||
137 | |||
138 | /* number ::= [n] <(non-negative decimal integer)> */ | ||
139 | |||
140 | -static long | ||
141 | +static int | ||
142 | d_number (struct d_info *di) | ||
143 | { | ||
144 | int negative; | ||
145 | char peek; | ||
146 | - long ret; | ||
147 | + int ret; | ||
148 | |||
149 | negative = 0; | ||
150 | peek = d_peek_char (di); | ||
151 | @@ -1681,7 +1688,7 @@ d_number_component (struct d_info *di) | ||
152 | /* identifier ::= <(unqualified source code identifier)> */ | ||
153 | |||
154 | static struct demangle_component * | ||
155 | -d_identifier (struct d_info *di, long len) | ||
156 | +d_identifier (struct d_info *di, int len) | ||
157 | { | ||
158 | const char *name; | ||
159 | |||
160 | @@ -1702,7 +1709,7 @@ d_identifier (struct d_info *di, long le | ||
161 | /* Look for something which looks like a gcc encoding of an | ||
162 | anonymous namespace, and replace it with a more user friendly | ||
163 | name. */ | ||
164 | - if (len >= (long) ANONYMOUS_NAMESPACE_PREFIX_LEN + 2 | ||
165 | + if (len >= (int) ANONYMOUS_NAMESPACE_PREFIX_LEN + 2 | ||
166 | && memcmp (name, ANONYMOUS_NAMESPACE_PREFIX, | ||
167 | ANONYMOUS_NAMESPACE_PREFIX_LEN) == 0) | ||
168 | { | ||
169 | @@ -1870,7 +1877,7 @@ d_java_resource (struct d_info *di) | ||
170 | { | ||
171 | struct demangle_component *p = NULL; | ||
172 | struct demangle_component *next = NULL; | ||
173 | - long len, i; | ||
174 | + int len, i; | ||
175 | char c; | ||
176 | const char *str; | ||
177 | |||
178 | @@ -2012,7 +2019,7 @@ d_special_name (struct d_info *di) | ||
179 | case 'C': | ||
180 | { | ||
181 | struct demangle_component *derived_type; | ||
182 | - long offset; | ||
183 | + int offset; | ||
184 | struct demangle_component *base_type; | ||
185 | |||
186 | derived_type = cplus_demangle_type (di); | ||
187 | @@ -2946,10 +2953,10 @@ d_pointer_to_member_type (struct d_info | ||
188 | |||
189 | /* <non-negative number> _ */ | ||
190 | |||
191 | -static long | ||
192 | +static int | ||
193 | d_compact_number (struct d_info *di) | ||
194 | { | ||
195 | - long num; | ||
196 | + int num; | ||
197 | if (d_peek_char (di) == '_') | ||
198 | num = 0; | ||
199 | else if (d_peek_char (di) == 'n') | ||
200 | @@ -2957,7 +2964,7 @@ d_compact_number (struct d_info *di) | ||
201 | else | ||
202 | num = d_number (di) + 1; | ||
203 | |||
204 | - if (! d_check_char (di, '_')) | ||
205 | + if (num < 0 || ! d_check_char (di, '_')) | ||
206 | return -1; | ||
207 | return num; | ||
208 | } | ||
209 | @@ -2969,7 +2976,7 @@ d_compact_number (struct d_info *di) | ||
210 | static struct demangle_component * | ||
211 | d_template_param (struct d_info *di) | ||
212 | { | ||
213 | - long param; | ||
214 | + int param; | ||
215 | |||
216 | if (! d_check_char (di, 'T')) | ||
217 | return NULL; | ||
218 | @@ -3171,9 +3178,10 @@ d_expression_1 (struct d_info *di) | ||
219 | } | ||
220 | else | ||
221 | { | ||
222 | - index = d_compact_number (di) + 1; | ||
223 | - if (index == 0) | ||
224 | + index = d_compact_number (di); | ||
225 | + if (index == INT_MAX || index == -1) | ||
226 | return NULL; | ||
227 | + index ++; | ||
228 | } | ||
229 | return d_make_function_param (di, index); | ||
230 | } | ||
231 | @@ -3502,7 +3510,7 @@ d_local_name (struct d_info *di) | ||
232 | static int | ||
233 | d_discriminator (struct d_info *di) | ||
234 | { | ||
235 | - long discrim; | ||
236 | + int discrim; | ||
237 | |||
238 | if (d_peek_char (di) != '_') | ||
239 | return 1; | ||
240 | @@ -3558,7 +3566,7 @@ static struct demangle_component * | ||
241 | d_unnamed_type (struct d_info *di) | ||
242 | { | ||
243 | struct demangle_component *ret; | ||
244 | - long num; | ||
245 | + int num; | ||
246 | |||
247 | if (! d_check_char (di, 'U')) | ||
248 | return NULL; | ||
249 | @@ -4086,10 +4094,10 @@ d_append_string (struct d_print_info *dp | ||
250 | } | ||
251 | |||
252 | static inline void | ||
253 | -d_append_num (struct d_print_info *dpi, long l) | ||
254 | +d_append_num (struct d_print_info *dpi, int l) | ||
255 | { | ||
256 | char buf[25]; | ||
257 | - sprintf (buf,"%ld", l); | ||
258 | + sprintf (buf,"%d", l); | ||
259 | d_append_string (dpi, buf); | ||
260 | } | ||
261 | |||
262 | Index: git/libiberty/testsuite/demangle-expected | ||
263 | =================================================================== | ||
264 | --- git.orig/libiberty/testsuite/demangle-expected | ||
265 | +++ git/libiberty/testsuite/demangle-expected | ||
266 | @@ -4422,12 +4422,22 @@ void baz<int>(A<sizeof (foo((int)(), (fl | ||
267 | _Z3fooI1FEN1XIXszdtcl1PclcvT__EEE5arrayEE4TypeEv | ||
268 | X<sizeof ((P(((F)())())).array)>::Type foo<F>() | ||
269 | # | ||
270 | -# Tests a use-after-free problem | ||
271 | +# Tests a use-after-free problem PR70481 | ||
272 | |||
273 | _Q.__0 | ||
274 | ::Q.(void) | ||
275 | # | ||
276 | -# Tests a use-after-free problem | ||
277 | +# Tests a use-after-free problem PR70481 | ||
278 | |||
279 | _Q10-__9cafebabe. | ||
280 | cafebabe.::-(void) | ||
281 | +# | ||
282 | +# Tests integer overflow problem PR70492 | ||
283 | + | ||
284 | +__vt_90000000000cafebabe | ||
285 | +__vt_90000000000cafebabe | ||
286 | +# | ||
287 | +# Tests write access violation PR70498 | ||
288 | + | ||
289 | +_Z80800000000000000000000 | ||
290 | +_Z80800000000000000000000 | ||