From 3079f7966dbed4497e36d5067cbfd896a90358cb Mon Sep 17 00:00:00 2001 From: Cyrill Gorcunov Date: Wed, 14 Nov 2018 10:03:42 +0300 Subject: [PATCH] preproc: Fix malformed parameter count readnum returns 64bit number which may become a negative integer upon conversion which in turn lead to out of bound array access. Fix it by explicit conversion with bounds check | POC6:2: error: parameter count `2222222222' is out of bounds [0; 2147483647] https://bugzilla.nasm.us/show_bug.cgi?id=3392528 Signed-off-by: Cyrill Gorcunov Upstream-Status: Backport CVE: CVE-2018-19755 Signed-off-by: Anuj Mittal --- asm/preproc.c | 43 +++++++++++++++++++++---------------------- 1 file changed, 21 insertions(+), 22 deletions(-) diff --git a/asm/preproc.c b/asm/preproc.c index b6afee3..e5ad05a 100644 --- a/asm/preproc.c +++ b/asm/preproc.c @@ -1650,6 +1650,23 @@ smacro_defined(Context * ctx, const char *name, int nparam, SMacro ** defn, return false; } +/* param should be a natural number [0; INT_MAX] */ +static int read_param_count(const char *str) +{ + int result; + bool err; + + result = readnum(str, &err); + if (result < 0 || result > INT_MAX) { + result = 0; + nasm_error(ERR_NONFATAL, "parameter count `%s' is out of bounds [%d; %d]", + str, 0, INT_MAX); + } else if (err) { + nasm_error(ERR_NONFATAL, "unable to parse parameter count `%s'", str); + } + return result; +} + /* * Count and mark off the parameters in a multi-line macro call. * This is called both from within the multi-line macro expansion @@ -1871,11 +1888,7 @@ static bool if_condition(Token * tline, enum preproc_token ct) pp_directives[ct]); } else { searching.nparam_min = searching.nparam_max = - readnum(tline->text, &j); - if (j) - nasm_error(ERR_NONFATAL, - "unable to parse parameter count `%s'", - tline->text); + read_param_count(tline->text); } if (tline && tok_is_(tline->next, "-")) { tline = tline->next->next; @@ -1886,11 +1899,7 @@ static bool if_condition(Token * tline, enum preproc_token ct) "`%s' expects a parameter count after `-'", pp_directives[ct]); else { - searching.nparam_max = readnum(tline->text, &j); - if (j) - nasm_error(ERR_NONFATAL, - "unable to parse parameter count `%s'", - tline->text); + searching.nparam_max = read_param_count(tline->text); if (searching.nparam_min > searching.nparam_max) { nasm_error(ERR_NONFATAL, "minimum parameter count exceeds maximum"); @@ -2079,8 +2088,6 @@ static void undef_smacro(Context *ctx, const char *mname) */ static bool parse_mmacro_spec(Token *tline, MMacro *def, const char *directive) { - bool err; - tline = tline->next; skip_white_(tline); tline = expand_id(tline); @@ -2103,11 +2110,7 @@ static bool parse_mmacro_spec(Token *tline, MMacro *def, const char *directive) if (!tok_type_(tline, TOK_NUMBER)) { nasm_error(ERR_NONFATAL, "`%s' expects a parameter count", directive); } else { - def->nparam_min = def->nparam_max = - readnum(tline->text, &err); - if (err) - nasm_error(ERR_NONFATAL, - "unable to parse parameter count `%s'", tline->text); + def->nparam_min = def->nparam_max = read_param_count(tline->text); } if (tline && tok_is_(tline->next, "-")) { tline = tline->next->next; @@ -2117,11 +2120,7 @@ static bool parse_mmacro_spec(Token *tline, MMacro *def, const char *directive) nasm_error(ERR_NONFATAL, "`%s' expects a parameter count after `-'", directive); } else { - def->nparam_max = readnum(tline->text, &err); - if (err) { - nasm_error(ERR_NONFATAL, "unable to parse parameter count `%s'", - tline->text); - } + def->nparam_max = read_param_count(tline->text); if (def->nparam_min > def->nparam_max) { nasm_error(ERR_NONFATAL, "minimum parameter count exceeds maximum"); def->nparam_max = def->nparam_min; -- 2.10.5.GIT