diff options
Diffstat (limited to 'meta/recipes-support/aspell/files/CVE-2019-25051.patch')
-rw-r--r-- | meta/recipes-support/aspell/files/CVE-2019-25051.patch | 101 |
1 files changed, 101 insertions, 0 deletions
diff --git a/meta/recipes-support/aspell/files/CVE-2019-25051.patch b/meta/recipes-support/aspell/files/CVE-2019-25051.patch new file mode 100644 index 0000000000..8513f6de79 --- /dev/null +++ b/meta/recipes-support/aspell/files/CVE-2019-25051.patch | |||
@@ -0,0 +1,101 @@ | |||
1 | From 0718b375425aad8e54e1150313b862e4c6fd324a Mon Sep 17 00:00:00 2001 | ||
2 | From: Kevin Atkinson <kevina@gnu.org> | ||
3 | Date: Sat, 21 Dec 2019 20:32:47 +0000 | ||
4 | Subject: [PATCH] objstack: assert that the alloc size will fit within a chunk | ||
5 | to prevent a buffer overflow | ||
6 | |||
7 | Bug found using OSS-Fuze. | ||
8 | |||
9 | Upstream-Status: Backport | ||
10 | [https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a] | ||
11 | CVE: CVE-2019-25051 | ||
12 | Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> | ||
13 | --- | ||
14 | common/objstack.hpp | 18 ++++++++++++++---- | ||
15 | 1 file changed, 14 insertions(+), 4 deletions(-) | ||
16 | |||
17 | diff --git a/common/objstack.hpp b/common/objstack.hpp | ||
18 | index 3997bf7..bd97ccd 100644 | ||
19 | --- a/common/objstack.hpp | ||
20 | +++ b/common/objstack.hpp | ||
21 | @@ -5,6 +5,7 @@ | ||
22 | #include "parm_string.hpp" | ||
23 | #include <stdlib.h> | ||
24 | #include <assert.h> | ||
25 | +#include <stddef.h> | ||
26 | |||
27 | namespace acommon { | ||
28 | |||
29 | @@ -26,6 +27,12 @@ class ObjStack | ||
30 | byte * temp_end; | ||
31 | void setup_chunk(); | ||
32 | void new_chunk(); | ||
33 | + bool will_overflow(size_t sz) const { | ||
34 | + return offsetof(Node,data) + sz > chunk_size; | ||
35 | + } | ||
36 | + void check_size(size_t sz) { | ||
37 | + assert(!will_overflow(sz)); | ||
38 | + } | ||
39 | |||
40 | ObjStack(const ObjStack &); | ||
41 | void operator=(const ObjStack &); | ||
42 | @@ -56,7 +63,7 @@ class ObjStack | ||
43 | void * alloc_bottom(size_t size) { | ||
44 | byte * tmp = bottom; | ||
45 | bottom += size; | ||
46 | - if (bottom > top) {new_chunk(); tmp = bottom; bottom += size;} | ||
47 | + if (bottom > top) {check_size(size); new_chunk(); tmp = bottom; bottom += size;} | ||
48 | return tmp; | ||
49 | } | ||
50 | // This alloc_bottom will insure that the object is aligned based on the | ||
51 | @@ -66,7 +73,7 @@ class ObjStack | ||
52 | align_bottom(align); | ||
53 | byte * tmp = bottom; | ||
54 | bottom += size; | ||
55 | - if (bottom > top) {new_chunk(); goto loop;} | ||
56 | + if (bottom > top) {check_size(size); new_chunk(); goto loop;} | ||
57 | return tmp; | ||
58 | } | ||
59 | char * dup_bottom(ParmString str) { | ||
60 | @@ -79,7 +86,7 @@ class ObjStack | ||
61 | // always be aligned as such. | ||
62 | void * alloc_top(size_t size) { | ||
63 | top -= size; | ||
64 | - if (top < bottom) {new_chunk(); top -= size;} | ||
65 | + if (top < bottom) {check_size(size); new_chunk(); top -= size;} | ||
66 | return top; | ||
67 | } | ||
68 | // This alloc_top will insure that the object is aligned based on | ||
69 | @@ -88,7 +95,7 @@ class ObjStack | ||
70 | {loop: | ||
71 | top -= size; | ||
72 | align_top(align); | ||
73 | - if (top < bottom) {new_chunk(); goto loop;} | ||
74 | + if (top < bottom) {check_size(size); new_chunk(); goto loop;} | ||
75 | return top; | ||
76 | } | ||
77 | char * dup_top(ParmString str) { | ||
78 | @@ -117,6 +124,7 @@ class ObjStack | ||
79 | void * alloc_temp(size_t size) { | ||
80 | temp_end = bottom + size; | ||
81 | if (temp_end > top) { | ||
82 | + check_size(size); | ||
83 | new_chunk(); | ||
84 | temp_end = bottom + size; | ||
85 | } | ||
86 | @@ -131,6 +139,7 @@ class ObjStack | ||
87 | } else { | ||
88 | size_t s = temp_end - bottom; | ||
89 | byte * p = bottom; | ||
90 | + check_size(size); | ||
91 | new_chunk(); | ||
92 | memcpy(bottom, p, s); | ||
93 | temp_end = bottom + size; | ||
94 | @@ -150,6 +159,7 @@ class ObjStack | ||
95 | } else { | ||
96 | size_t s = temp_end - bottom; | ||
97 | byte * p = bottom; | ||
98 | + check_size(size); | ||
99 | new_chunk(); | ||
100 | memcpy(bottom, p, s); | ||
101 | temp_end = bottom + size; | ||