diff options
Diffstat (limited to 'meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch')
-rw-r--r-- | meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch | 65 |
1 files changed, 0 insertions, 65 deletions
diff --git a/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch b/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch deleted file mode 100644 index a56a08b5a8..0000000000 --- a/meta/recipes-devtools/nasm/nasm/0001-Verify-that-we-are-not-reading-past-end-of-a-buffer.patch +++ /dev/null | |||
@@ -1,65 +0,0 @@ | |||
1 | From c5785fdf1d660eaefb9711284414262d0cfe8843 Mon Sep 17 00:00:00 2001 | ||
2 | From: Adam Majer <amajer@suse.de> | ||
3 | Date: Fri, 17 Aug 2018 14:48:17 +0800 | ||
4 | Subject: [PATCH] Verify that we are not reading past end of a buffer | ||
5 | |||
6 | Simple reproducer is just, | ||
7 | |||
8 | ret &d:ep | ||
9 | |||
10 | which triggers a buffer overread due to parsing of an invalid | ||
11 | segment override. | ||
12 | |||
13 | Signed-off-by: Adam Majer <amajer@suse.de> | ||
14 | |||
15 | Upstream-Status: Submitted [https://bugzilla.nasm.us/show_bug.cgi?id=3392447] | ||
16 | CVE: CVE-2018-8883 | ||
17 | Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> | ||
18 | --- | ||
19 | include/opflags.h | 2 +- | ||
20 | include/tables.h | 1 + | ||
21 | x86/regs.pl | 3 ++- | ||
22 | 3 files changed, 4 insertions(+), 2 deletions(-) | ||
23 | |||
24 | diff --git a/include/opflags.h b/include/opflags.h | ||
25 | index ef2838c1..8d4b6b1e 100644 | ||
26 | --- a/include/opflags.h | ||
27 | +++ b/include/opflags.h | ||
28 | @@ -166,7 +166,7 @@ | ||
29 | #define REG_CLASS_BND GEN_REG_CLASS(9) | ||
30 | |||
31 | #define is_class(class, op) (!((opflags_t)(class) & ~(opflags_t)(op))) | ||
32 | -#define is_reg_class(class, reg) is_class((class), nasm_reg_flags[(reg)]) | ||
33 | +#define is_reg_class(class, reg) is_class((class), ((reg) < nasm_reg_flags_size ? nasm_reg_flags[(reg)] : 0)) | ||
34 | |||
35 | #define IS_SREG(reg) is_reg_class(REG_SREG, (reg)) | ||
36 | #define IS_FSGS(reg) is_reg_class(REG_FSGS, (reg)) | ||
37 | diff --git a/include/tables.h b/include/tables.h | ||
38 | index 24a665e2..458752ce 100644 | ||
39 | --- a/include/tables.h | ||
40 | +++ b/include/tables.h | ||
41 | @@ -64,6 +64,7 @@ extern const char * const nasm_reg_names[]; | ||
42 | typedef uint64_t opflags_t; | ||
43 | typedef uint16_t decoflags_t; | ||
44 | extern const opflags_t nasm_reg_flags[]; | ||
45 | +extern const size_t nasm_reg_flags_size; | ||
46 | /* regvals.c */ | ||
47 | extern const int nasm_regvals[]; | ||
48 | |||
49 | diff --git a/x86/regs.pl b/x86/regs.pl | ||
50 | index 3a1b56f5..cb5cea68 100755 | ||
51 | --- a/x86/regs.pl | ||
52 | +++ b/x86/regs.pl | ||
53 | @@ -158,7 +158,8 @@ if ( $fmt eq 'h' ) { | ||
54 | printf " %-15s /* %-5s */\n", | ||
55 | $regs{$reg}.',', $reg; | ||
56 | } | ||
57 | - print "};\n"; | ||
58 | + print "};\n\n"; | ||
59 | + print "const size_t nasm_reg_flags_size = sizeof(nasm_reg_flags) / sizeof(opflags_t);\n"; | ||
60 | } elsif ( $fmt eq 'vc' ) { | ||
61 | # Output regvals.c | ||
62 | print "/* automatically generated from $file - do not edit */\n\n"; | ||
63 | -- | ||
64 | 2.17.1 | ||
65 | |||