diff options
Diffstat (limited to 'meta/recipes-core/glibc/glibc/CVE-2020-6096-2.patch')
-rw-r--r-- | meta/recipes-core/glibc/glibc/CVE-2020-6096-2.patch | 111 |
1 files changed, 111 insertions, 0 deletions
diff --git a/meta/recipes-core/glibc/glibc/CVE-2020-6096-2.patch b/meta/recipes-core/glibc/glibc/CVE-2020-6096-2.patch new file mode 100644 index 0000000000..bfb2d7e7f5 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/CVE-2020-6096-2.patch | |||
@@ -0,0 +1,111 @@ | |||
1 | From beea361050728138b82c57dda0c4810402d342b9 Mon Sep 17 00:00:00 2001 | ||
2 | From: Alexander Anisimov <a.anisimov@omprussia.ru> | ||
3 | Date: Wed, 8 Jul 2020 14:18:31 +0200 | ||
4 | Subject: [PATCH 2/2] arm: CVE-2020-6096: Fix multiarch memcpy for negative | ||
5 | length [BZ #25620] | ||
6 | |||
7 | Unsigned branch instructions could be used for r2 to fix the wrong | ||
8 | behavior when a negative length is passed to memcpy. | ||
9 | This commit fixes the armv7 version. | ||
10 | |||
11 | CVE: CVE-2020-6096 | ||
12 | Upstream-Status: Backport [git://sourceware.org/git/glibc.git] | ||
13 | Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> | ||
14 | --- | ||
15 | sysdeps/arm/armv7/multiarch/memcpy_impl.S | 22 +++++++++++----------- | ||
16 | 1 file changed, 11 insertions(+), 11 deletions(-) | ||
17 | |||
18 | diff --git a/sysdeps/arm/armv7/multiarch/memcpy_impl.S b/sysdeps/arm/armv7/multiarch/memcpy_impl.S | ||
19 | index bf4ac7077f..379bb56fc9 100644 | ||
20 | --- a/sysdeps/arm/armv7/multiarch/memcpy_impl.S | ||
21 | +++ b/sysdeps/arm/armv7/multiarch/memcpy_impl.S | ||
22 | @@ -268,7 +268,7 @@ ENTRY(memcpy) | ||
23 | |||
24 | mov dst, dstin /* Preserve dstin, we need to return it. */ | ||
25 | cmp count, #64 | ||
26 | - bge .Lcpy_not_short | ||
27 | + bhs .Lcpy_not_short | ||
28 | /* Deal with small copies quickly by dropping straight into the | ||
29 | exit block. */ | ||
30 | |||
31 | @@ -351,10 +351,10 @@ ENTRY(memcpy) | ||
32 | |||
33 | 1: | ||
34 | subs tmp2, count, #64 /* Use tmp2 for count. */ | ||
35 | - blt .Ltail63aligned | ||
36 | + blo .Ltail63aligned | ||
37 | |||
38 | cmp tmp2, #512 | ||
39 | - bge .Lcpy_body_long | ||
40 | + bhs .Lcpy_body_long | ||
41 | |||
42 | .Lcpy_body_medium: /* Count in tmp2. */ | ||
43 | #ifdef USE_VFP | ||
44 | @@ -378,7 +378,7 @@ ENTRY(memcpy) | ||
45 | add src, src, #64 | ||
46 | vstr d1, [dst, #56] | ||
47 | add dst, dst, #64 | ||
48 | - bge 1b | ||
49 | + bhs 1b | ||
50 | tst tmp2, #0x3f | ||
51 | beq .Ldone | ||
52 | |||
53 | @@ -412,7 +412,7 @@ ENTRY(memcpy) | ||
54 | ldrd A_l, A_h, [src, #64]! | ||
55 | strd A_l, A_h, [dst, #64]! | ||
56 | subs tmp2, tmp2, #64 | ||
57 | - bge 1b | ||
58 | + bhs 1b | ||
59 | tst tmp2, #0x3f | ||
60 | bne 1f | ||
61 | ldr tmp2,[sp], #FRAME_SIZE | ||
62 | @@ -482,7 +482,7 @@ ENTRY(memcpy) | ||
63 | add src, src, #32 | ||
64 | |||
65 | subs tmp2, tmp2, #prefetch_lines * 64 * 2 | ||
66 | - blt 2f | ||
67 | + blo 2f | ||
68 | 1: | ||
69 | cpy_line_vfp d3, 0 | ||
70 | cpy_line_vfp d4, 64 | ||
71 | @@ -494,7 +494,7 @@ ENTRY(memcpy) | ||
72 | add dst, dst, #2 * 64 | ||
73 | add src, src, #2 * 64 | ||
74 | subs tmp2, tmp2, #prefetch_lines * 64 | ||
75 | - bge 1b | ||
76 | + bhs 1b | ||
77 | |||
78 | 2: | ||
79 | cpy_tail_vfp d3, 0 | ||
80 | @@ -615,8 +615,8 @@ ENTRY(memcpy) | ||
81 | 1: | ||
82 | pld [src, #(3 * 64)] | ||
83 | subs count, count, #64 | ||
84 | - ldrmi tmp2, [sp], #FRAME_SIZE | ||
85 | - bmi .Ltail63unaligned | ||
86 | + ldrlo tmp2, [sp], #FRAME_SIZE | ||
87 | + blo .Ltail63unaligned | ||
88 | pld [src, #(4 * 64)] | ||
89 | |||
90 | #ifdef USE_NEON | ||
91 | @@ -633,7 +633,7 @@ ENTRY(memcpy) | ||
92 | neon_load_multi d0-d3, src | ||
93 | neon_load_multi d4-d7, src | ||
94 | subs count, count, #64 | ||
95 | - bmi 2f | ||
96 | + blo 2f | ||
97 | 1: | ||
98 | pld [src, #(4 * 64)] | ||
99 | neon_store_multi d0-d3, dst | ||
100 | @@ -641,7 +641,7 @@ ENTRY(memcpy) | ||
101 | neon_store_multi d4-d7, dst | ||
102 | neon_load_multi d4-d7, src | ||
103 | subs count, count, #64 | ||
104 | - bpl 1b | ||
105 | + bhs 1b | ||
106 | 2: | ||
107 | neon_store_multi d0-d3, dst | ||
108 | neon_store_multi d4-d7, dst | ||
109 | -- | ||
110 | 2.17.0 | ||
111 | |||