diff options
Diffstat (limited to 'meta/recipes-core/glibc/glibc/CVE-2020-29562.patch')
-rw-r--r-- | meta/recipes-core/glibc/glibc/CVE-2020-29562.patch | 155 |
1 files changed, 0 insertions, 155 deletions
diff --git a/meta/recipes-core/glibc/glibc/CVE-2020-29562.patch b/meta/recipes-core/glibc/glibc/CVE-2020-29562.patch deleted file mode 100644 index 134b4e3613..0000000000 --- a/meta/recipes-core/glibc/glibc/CVE-2020-29562.patch +++ /dev/null | |||
@@ -1,155 +0,0 @@ | |||
1 | From 228edd356f03bf62dcf2b1335f25d43c602ee68d Mon Sep 17 00:00:00 2001 | ||
2 | From: Michael Colavita <mcolavita@fb.com> | ||
3 | Date: Thu, 19 Nov 2020 11:44:40 -0500 | ||
4 | Subject: [PATCH] iconv: Fix incorrect UCS4 inner loop bounds (BZ#26923) | ||
5 | |||
6 | Previously, in UCS4 conversion routines we limit the number of | ||
7 | characters we examine to the minimum of the number of characters in the | ||
8 | input and the number of characters in the output. This is not the | ||
9 | correct behavior when __GCONV_IGNORE_ERRORS is set, as we do not consume | ||
10 | an output character when we skip a code unit. Instead, track the input | ||
11 | and output pointers and terminate the loop when either reaches its | ||
12 | limit. | ||
13 | |||
14 | This resolves assertion failures when resetting the input buffer in a step of | ||
15 | iconv, which assumes that the input will be fully consumed given sufficient | ||
16 | output space. | ||
17 | |||
18 | Upstream-Status: Backport [git://sourceware.org/git/glibc.git] | ||
19 | CVE: CVE-2020-29562 | ||
20 | Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> | ||
21 | --- | ||
22 | iconv/Makefile | 2 +- | ||
23 | iconv/gconv_simple.c | 16 ++++---------- | ||
24 | iconv/tst-iconv8.c | 50 ++++++++++++++++++++++++++++++++++++++++++++ | ||
25 | 3 files changed, 55 insertions(+), 13 deletions(-) | ||
26 | create mode 100644 iconv/tst-iconv8.c | ||
27 | |||
28 | diff --git a/iconv/Makefile b/iconv/Makefile | ||
29 | index 30bf996d3a..f9b51e23ec 100644 | ||
30 | --- a/iconv/Makefile | ||
31 | +++ b/iconv/Makefile | ||
32 | @@ -44,7 +44,7 @@ CFLAGS-linereader.c += -DNO_TRANSLITERATION | ||
33 | CFLAGS-simple-hash.c += -I../locale | ||
34 | |||
35 | tests = tst-iconv1 tst-iconv2 tst-iconv3 tst-iconv4 tst-iconv5 tst-iconv6 \ | ||
36 | - tst-iconv7 tst-iconv-mt tst-iconv-opt | ||
37 | + tst-iconv7 tst-iconv8 tst-iconv-mt tst-iconv-opt | ||
38 | |||
39 | others = iconv_prog iconvconfig | ||
40 | install-others-programs = $(inst_bindir)/iconv | ||
41 | diff --git a/iconv/gconv_simple.c b/iconv/gconv_simple.c | ||
42 | index d4797fba17..963b29f246 100644 | ||
43 | --- a/iconv/gconv_simple.c | ||
44 | +++ b/iconv/gconv_simple.c | ||
45 | @@ -239,11 +239,9 @@ ucs4_internal_loop (struct __gconv_step *step, | ||
46 | int flags = step_data->__flags; | ||
47 | const unsigned char *inptr = *inptrp; | ||
48 | unsigned char *outptr = *outptrp; | ||
49 | - size_t n_convert = MIN (inend - inptr, outend - outptr) / 4; | ||
50 | int result; | ||
51 | - size_t cnt; | ||
52 | |||
53 | - for (cnt = 0; cnt < n_convert; ++cnt, inptr += 4) | ||
54 | + for (; inptr + 4 <= inend && outptr + 4 <= outend; inptr += 4) | ||
55 | { | ||
56 | uint32_t inval; | ||
57 | |||
58 | @@ -307,11 +305,9 @@ ucs4_internal_loop_unaligned (struct __gconv_step *step, | ||
59 | int flags = step_data->__flags; | ||
60 | const unsigned char *inptr = *inptrp; | ||
61 | unsigned char *outptr = *outptrp; | ||
62 | - size_t n_convert = MIN (inend - inptr, outend - outptr) / 4; | ||
63 | int result; | ||
64 | - size_t cnt; | ||
65 | |||
66 | - for (cnt = 0; cnt < n_convert; ++cnt, inptr += 4) | ||
67 | + for (; inptr + 4 <= inend && outptr + 4 <= outend; inptr += 4) | ||
68 | { | ||
69 | if (__glibc_unlikely (inptr[0] > 0x80)) | ||
70 | { | ||
71 | @@ -613,11 +609,9 @@ ucs4le_internal_loop (struct __gconv_step *step, | ||
72 | int flags = step_data->__flags; | ||
73 | const unsigned char *inptr = *inptrp; | ||
74 | unsigned char *outptr = *outptrp; | ||
75 | - size_t n_convert = MIN (inend - inptr, outend - outptr) / 4; | ||
76 | int result; | ||
77 | - size_t cnt; | ||
78 | |||
79 | - for (cnt = 0; cnt < n_convert; ++cnt, inptr += 4) | ||
80 | + for (; inptr + 4 <= inend && outptr + 4 <= outend; inptr += 4) | ||
81 | { | ||
82 | uint32_t inval; | ||
83 | |||
84 | @@ -684,11 +678,9 @@ ucs4le_internal_loop_unaligned (struct __gconv_step *step, | ||
85 | int flags = step_data->__flags; | ||
86 | const unsigned char *inptr = *inptrp; | ||
87 | unsigned char *outptr = *outptrp; | ||
88 | - size_t n_convert = MIN (inend - inptr, outend - outptr) / 4; | ||
89 | int result; | ||
90 | - size_t cnt; | ||
91 | |||
92 | - for (cnt = 0; cnt < n_convert; ++cnt, inptr += 4) | ||
93 | + for (; inptr + 4 <= inend && outptr + 4 <= outend; inptr += 4) | ||
94 | { | ||
95 | if (__glibc_unlikely (inptr[3] > 0x80)) | ||
96 | { | ||
97 | diff --git a/iconv/tst-iconv8.c b/iconv/tst-iconv8.c | ||
98 | new file mode 100644 | ||
99 | index 0000000000..0b92b19f66 | ||
100 | --- /dev/null | ||
101 | +++ b/iconv/tst-iconv8.c | ||
102 | @@ -0,0 +1,50 @@ | ||
103 | +/* Test iconv behavior on UCS4 conversions with //IGNORE. | ||
104 | + Copyright (C) 2020 Free Software Foundation, Inc. | ||
105 | + This file is part of the GNU C Library. | ||
106 | + | ||
107 | + The GNU C Library is free software; you can redistribute it and/or | ||
108 | + modify it under the terms of the GNU Lesser General Public | ||
109 | + License as published by the Free Software Foundation; either | ||
110 | + version 2.1 of the License, or (at your option) any later version. | ||
111 | + | ||
112 | + The GNU C Library is distributed in the hope that it will be useful, | ||
113 | + but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
114 | + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | ||
115 | + Lesser General Public License for more details. | ||
116 | + | ||
117 | + You should have received a copy of the GNU Lesser General Public | ||
118 | + License along with the GNU C Library; if not, see | ||
119 | + <http://www.gnu.org/licenses/>. */ | ||
120 | + | ||
121 | +/* Derived from BZ #26923 */ | ||
122 | +#include <errno.h> | ||
123 | +#include <iconv.h> | ||
124 | +#include <stdio.h> | ||
125 | +#include <support/check.h> | ||
126 | + | ||
127 | +static int | ||
128 | +do_test (void) | ||
129 | +{ | ||
130 | + iconv_t cd = iconv_open ("UTF-8//IGNORE", "ISO-10646/UCS4/"); | ||
131 | + TEST_VERIFY_EXIT (cd != (iconv_t) -1); | ||
132 | + | ||
133 | + /* | ||
134 | + * Convert sequence beginning with an irreversible character into buffer that | ||
135 | + * is too small. | ||
136 | + */ | ||
137 | + char input[12] = "\xe1\x80\xa1" "AAAAAAAAA"; | ||
138 | + char *inptr = input; | ||
139 | + size_t insize = sizeof (input); | ||
140 | + char output[6]; | ||
141 | + char *outptr = output; | ||
142 | + size_t outsize = sizeof (output); | ||
143 | + | ||
144 | + TEST_VERIFY (iconv (cd, &inptr, &insize, &outptr, &outsize) == -1); | ||
145 | + TEST_VERIFY (errno == E2BIG); | ||
146 | + | ||
147 | + TEST_VERIFY_EXIT (iconv_close (cd) != -1); | ||
148 | + | ||
149 | + return 0; | ||
150 | +} | ||
151 | + | ||
152 | +#include <support/test-driver.c> | ||
153 | -- | ||
154 | 2.17.0 | ||
155 | |||