diff options
Diffstat (limited to 'meta/recipes-core/glibc/glibc/CVE-2019-6488.patch')
-rw-r--r-- | meta/recipes-core/glibc/glibc/CVE-2019-6488.patch | 274 |
1 files changed, 274 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/CVE-2019-6488.patch b/meta/recipes-core/glibc/glibc/CVE-2019-6488.patch new file mode 100644 index 0000000000..fa423754d4 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/CVE-2019-6488.patch | |||
@@ -0,0 +1,274 @@ | |||
1 | From 718016100d889a986c536b595bf6ec0d6ab4b90e Mon Sep 17 00:00:00 2001 | ||
2 | From: "H.J. Lu" <hjl.tools@gmail.com> | ||
3 | Date: Fri, 1 Feb 2019 12:17:09 -0800 | ||
4 | Subject: [PATCH] x86-64 memchr/wmemchr: Properly handle the length parameter | ||
5 | [BZ #24097] | ||
6 | Reply-To: muislam@microsoft.com | ||
7 | |||
8 | On x32, the size_t parameter may be passed in the lower 32 bits of a | ||
9 | 64-bit register with the non-zero upper 32 bits. The string/memory | ||
10 | functions written in assembly can only use the lower 32 bits of a | ||
11 | 64-bit register as length or must clear the upper 32 bits before using | ||
12 | the full 64-bit register for length. | ||
13 | |||
14 | This pach fixes memchr/wmemchr for x32. Tested on x86-64 and x32. On | ||
15 | x86-64, libc.so is the same with and withou the fix. | ||
16 | |||
17 | [BZ #24097] | ||
18 | CVE-2019-6488 | ||
19 | * sysdeps/x86_64/memchr.S: Use RDX_LP for length. Clear the | ||
20 | upper 32 bits of RDX register. | ||
21 | * sysdeps/x86_64/multiarch/memchr-avx2.S: Likewise. | ||
22 | * sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memchr and | ||
23 | tst-size_t-wmemchr. | ||
24 | * sysdeps/x86_64/x32/test-size_t.h: New file. | ||
25 | * sysdeps/x86_64/x32/tst-size_t-memchr.c: Likewise. | ||
26 | * sysdeps/x86_64/x32/tst-size_t-wmemchr.c: Likewise. | ||
27 | |||
28 | (cherry picked from commit 97700a34f36721b11a754cf37a1cc40695ece1fd) | ||
29 | |||
30 | CVE: CVE-2019-6488 | ||
31 | |||
32 | Upstream-Status: Backport | ||
33 | |||
34 | Signed-off-by: Muminul Islam <muislam@microsoft.com> | ||
35 | --- | ||
36 | NEWS | 1 - | ||
37 | sysdeps/x86_64/memchr.S | 10 ++-- | ||
38 | sysdeps/x86_64/multiarch/memchr-avx2.S | 8 ++- | ||
39 | sysdeps/x86_64/x32/Makefile | 8 +++ | ||
40 | sysdeps/x86_64/x32/test-size_t.h | 35 ++++++++++++ | ||
41 | sysdeps/x86_64/x32/tst-size_t-memchr.c | 72 +++++++++++++++++++++++++ | ||
42 | sysdeps/x86_64/x32/tst-size_t-wmemchr.c | 20 +++++++ | ||
43 | 7 files changed, 148 insertions(+), 6 deletions(-) | ||
44 | create mode 100644 sysdeps/x86_64/x32/test-size_t.h | ||
45 | create mode 100644 sysdeps/x86_64/x32/tst-size_t-memchr.c | ||
46 | create mode 100644 sysdeps/x86_64/x32/tst-size_t-wmemchr.c | ||
47 | |||
48 | diff --git a/NEWS b/NEWS | ||
49 | index fd14941128..b158973a30 100644 | ||
50 | --- a/NEWS | ||
51 | +++ b/NEWS | ||
52 | @@ -17,7 +17,6 @@ The following bugs are resolved with this release: | ||
53 | [23606] Missing ENDBR32 in sysdeps/i386/start.S | ||
54 | [23679] gethostid: Missing NULL check for gethostbyname_r result | ||
55 | [23717] Fix stack overflow in stdlib/tst-setcontext9 | ||
56 | - | ||
57 | |||
58 | Version 2.28 | ||
59 | |||
60 | diff --git a/sysdeps/x86_64/memchr.S b/sysdeps/x86_64/memchr.S | ||
61 | index feef5d4f24..cb320257a2 100644 | ||
62 | --- a/sysdeps/x86_64/memchr.S | ||
63 | +++ b/sysdeps/x86_64/memchr.S | ||
64 | @@ -34,12 +34,16 @@ ENTRY(MEMCHR) | ||
65 | mov %edi, %ecx | ||
66 | |||
67 | #ifdef USE_AS_WMEMCHR | ||
68 | - test %rdx, %rdx | ||
69 | + test %RDX_LP, %RDX_LP | ||
70 | jz L(return_null) | ||
71 | - shl $2, %rdx | ||
72 | + shl $2, %RDX_LP | ||
73 | #else | ||
74 | +# ifdef __ILP32__ | ||
75 | + /* Clear the upper 32 bits. */ | ||
76 | + movl %edx, %edx | ||
77 | +# endif | ||
78 | punpcklbw %xmm1, %xmm1 | ||
79 | - test %rdx, %rdx | ||
80 | + test %RDX_LP, %RDX_LP | ||
81 | jz L(return_null) | ||
82 | punpcklbw %xmm1, %xmm1 | ||
83 | #endif | ||
84 | diff --git a/sysdeps/x86_64/multiarch/memchr-avx2.S b/sysdeps/x86_64/multiarch/memchr-avx2.S | ||
85 | index 5f5e772554..c81da19bf0 100644 | ||
86 | --- a/sysdeps/x86_64/multiarch/memchr-avx2.S | ||
87 | +++ b/sysdeps/x86_64/multiarch/memchr-avx2.S | ||
88 | @@ -40,16 +40,20 @@ | ||
89 | ENTRY (MEMCHR) | ||
90 | # ifndef USE_AS_RAWMEMCHR | ||
91 | /* Check for zero length. */ | ||
92 | - testq %rdx, %rdx | ||
93 | + test %RDX_LP, %RDX_LP | ||
94 | jz L(null) | ||
95 | # endif | ||
96 | movl %edi, %ecx | ||
97 | /* Broadcast CHAR to YMM0. */ | ||
98 | vmovd %esi, %xmm0 | ||
99 | # ifdef USE_AS_WMEMCHR | ||
100 | - shl $2, %rdx | ||
101 | + shl $2, %RDX_LP | ||
102 | vpbroadcastd %xmm0, %ymm0 | ||
103 | # else | ||
104 | +# ifdef __ILP32__ | ||
105 | + /* Clear the upper 32 bits. */ | ||
106 | + movl %edx, %edx | ||
107 | +# endif | ||
108 | vpbroadcastb %xmm0, %ymm0 | ||
109 | # endif | ||
110 | /* Check if we may cross page boundary with one vector load. */ | ||
111 | diff --git a/sysdeps/x86_64/x32/Makefile b/sysdeps/x86_64/x32/Makefile | ||
112 | index f2ebc24fb0..7d528889c6 100644 | ||
113 | --- a/sysdeps/x86_64/x32/Makefile | ||
114 | +++ b/sysdeps/x86_64/x32/Makefile | ||
115 | @@ -4,3 +4,11 @@ ifeq ($(subdir),math) | ||
116 | # 64-bit llround. Add -fno-builtin-lround to silence the compiler. | ||
117 | CFLAGS-s_llround.c += -fno-builtin-lround | ||
118 | endif | ||
119 | + | ||
120 | +ifeq ($(subdir),string) | ||
121 | +tests += tst-size_t-memchr | ||
122 | +endif | ||
123 | + | ||
124 | +ifeq ($(subdir),wcsmbs) | ||
125 | +tests += tst-size_t-wmemchr | ||
126 | +endif | ||
127 | diff --git a/sysdeps/x86_64/x32/test-size_t.h b/sysdeps/x86_64/x32/test-size_t.h | ||
128 | new file mode 100644 | ||
129 | index 0000000000..78a940863e | ||
130 | --- /dev/null | ||
131 | +++ b/sysdeps/x86_64/x32/test-size_t.h | ||
132 | @@ -0,0 +1,35 @@ | ||
133 | +/* Test string/memory functions with size_t in the lower 32 bits of | ||
134 | + 64-bit register. | ||
135 | + Copyright (C) 2019 Free Software Foundation, Inc. | ||
136 | + This file is part of the GNU C Library. | ||
137 | + | ||
138 | + The GNU C Library is free software; you can redistribute it and/or | ||
139 | + modify it under the terms of the GNU Lesser General Public | ||
140 | + License as published by the Free Software Foundation; either | ||
141 | + version 2.1 of the License, or (at your option) any later version. | ||
142 | + | ||
143 | + The GNU C Library is distributed in the hope that it will be useful, | ||
144 | + but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
145 | + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | ||
146 | + Lesser General Public License for more details. | ||
147 | + | ||
148 | + You should have received a copy of the GNU Lesser General Public | ||
149 | + License along with the GNU C Library; if not, see | ||
150 | + <http://www.gnu.org/licenses/>. */ | ||
151 | + | ||
152 | +#define TEST_MAIN | ||
153 | +#include <string/test-string.h> | ||
154 | + | ||
155 | +/* On x32, parameter_t may be passed in a 64-bit register with the LEN | ||
156 | + field in the lower 32 bits. When the LEN field of 64-bit register | ||
157 | + is passed to string/memory function as the size_t parameter, only | ||
158 | + the lower 32 bits can be used. */ | ||
159 | +typedef struct | ||
160 | +{ | ||
161 | + union | ||
162 | + { | ||
163 | + size_t len; | ||
164 | + void (*fn) (void); | ||
165 | + }; | ||
166 | + void *p; | ||
167 | +} parameter_t; | ||
168 | diff --git a/sysdeps/x86_64/x32/tst-size_t-memchr.c b/sysdeps/x86_64/x32/tst-size_t-memchr.c | ||
169 | new file mode 100644 | ||
170 | index 0000000000..29a3daf102 | ||
171 | --- /dev/null | ||
172 | +++ b/sysdeps/x86_64/x32/tst-size_t-memchr.c | ||
173 | @@ -0,0 +1,72 @@ | ||
174 | +/* Test memchr with size_t in the lower 32 bits of 64-bit register. | ||
175 | + Copyright (C) 2019 Free Software Foundation, Inc. | ||
176 | + This file is part of the GNU C Library. | ||
177 | + | ||
178 | + The GNU C Library is free software; you can redistribute it and/or | ||
179 | + modify it under the terms of the GNU Lesser General Public | ||
180 | + License as published by the Free Software Foundation; either | ||
181 | + version 2.1 of the License, or (at your option) any later version. | ||
182 | + | ||
183 | + The GNU C Library is distributed in the hope that it will be useful, | ||
184 | + but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
185 | + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | ||
186 | + Lesser General Public License for more details. | ||
187 | + | ||
188 | + You should have received a copy of the GNU Lesser General Public | ||
189 | + License along with the GNU C Library; if not, see | ||
190 | + <http://www.gnu.org/licenses/>. */ | ||
191 | + | ||
192 | +#ifndef WIDE | ||
193 | +# define TEST_NAME "memchr" | ||
194 | +#else | ||
195 | +# define TEST_NAME "wmemchr" | ||
196 | +#endif /* WIDE */ | ||
197 | +#include "test-size_t.h" | ||
198 | + | ||
199 | +#ifndef WIDE | ||
200 | +# define MEMCHR memchr | ||
201 | +# define CHAR char | ||
202 | +# define UCHAR unsigned char | ||
203 | +#else | ||
204 | +# include <wchar.h> | ||
205 | +# define MEMCHR wmemchr | ||
206 | +# define CHAR wchar_t | ||
207 | +# define UCHAR wchar_t | ||
208 | +#endif /* WIDE */ | ||
209 | + | ||
210 | +IMPL (MEMCHR, 1) | ||
211 | + | ||
212 | +typedef CHAR * (*proto_t) (const CHAR*, int, size_t); | ||
213 | + | ||
214 | +static CHAR * | ||
215 | +__attribute__ ((noinline, noclone)) | ||
216 | +do_memchr (parameter_t a, parameter_t b) | ||
217 | +{ | ||
218 | + return CALL (&b, a.p, (uintptr_t) b.p, a.len); | ||
219 | +} | ||
220 | + | ||
221 | +static int | ||
222 | +test_main (void) | ||
223 | +{ | ||
224 | + test_init (); | ||
225 | + | ||
226 | + parameter_t src = { { page_size / sizeof (CHAR) }, buf2 }; | ||
227 | + parameter_t c = { { 0 }, (void *) (uintptr_t) 0x12 }; | ||
228 | + | ||
229 | + int ret = 0; | ||
230 | + FOR_EACH_IMPL (impl, 0) | ||
231 | + { | ||
232 | + c.fn = impl->fn; | ||
233 | + CHAR *res = do_memchr (src, c); | ||
234 | + if (res) | ||
235 | + { | ||
236 | + error (0, 0, "Wrong result in function %s: %p != NULL", | ||
237 | + impl->name, res); | ||
238 | + ret = 1; | ||
239 | + } | ||
240 | + } | ||
241 | + | ||
242 | + return ret ? EXIT_FAILURE : EXIT_SUCCESS; | ||
243 | +} | ||
244 | + | ||
245 | +#include <support/test-driver.c> | ||
246 | diff --git a/sysdeps/x86_64/x32/tst-size_t-wmemchr.c b/sysdeps/x86_64/x32/tst-size_t-wmemchr.c | ||
247 | new file mode 100644 | ||
248 | index 0000000000..877801d646 | ||
249 | --- /dev/null | ||
250 | +++ b/sysdeps/x86_64/x32/tst-size_t-wmemchr.c | ||
251 | @@ -0,0 +1,20 @@ | ||
252 | +/* Test wmemchr with size_t in the lower 32 bits of 64-bit register. | ||
253 | + Copyright (C) 2019 Free Software Foundation, Inc. | ||
254 | + This file is part of the GNU C Library. | ||
255 | + | ||
256 | + The GNU C Library is free software; you can redistribute it and/or | ||
257 | + modify it under the terms of the GNU Lesser General Public | ||
258 | + License as published by the Free Software Foundation; either | ||
259 | + version 2.1 of the License, or (at your option) any later version. | ||
260 | + | ||
261 | + The GNU C Library is distributed in the hope that it will be useful, | ||
262 | + but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
263 | + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | ||
264 | + Lesser General Public License for more details. | ||
265 | + | ||
266 | + You should have received a copy of the GNU Lesser General Public | ||
267 | + License along with the GNU C Library; if not, see | ||
268 | + <http://www.gnu.org/licenses/>. */ | ||
269 | + | ||
270 | +#define WIDE 1 | ||
271 | +#include "tst-size_t-memchr.c" | ||
272 | -- | ||
273 | 2.23.0 | ||
274 | |||