summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJose Quaresma <quaresma.jose@gmail.com>2024-07-16 15:16:37 +0100
committerRichard Purdie <richard.purdie@linuxfoundation.org>2024-07-18 17:21:39 +0100
commit7b8d63b1e24d2627e14c0762c0882b1f92360804 (patch)
tree54368720ea35155db695b32d128beada943d7b32
parentd9066258a1e48e75cf814fb0940ac420bcdd6e99 (diff)
downloadpoky-7b8d63b1e24d2627e14c0762c0882b1f92360804.tar.gz
openssh: drop rejected patch fixed in 8.6p1 release
The rationale [1] is that C11 6.5.6.9 says: """ When two pointers are subtracted, both shall point to elements of the same array object, or one past the last element of the array object; the result is the difference of the subscripts of the two array elements. """ In these cases the objects are arrays of char so the result is defined, and we believe that the compiler incorrectly trapping on defined behaviour. I also found https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63303 ("Pointer subtraction is broken when using -fsanitize=undefined") which seems to support this position. [1] https://bugzilla.mindrot.org/show_bug.cgi?id=2608 (From OE-Core rev: cf193ea67ca852e76b19a7997b62f043b1bca8a1) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch111
-rw-r--r--meta/recipes-connectivity/openssh/openssh_9.7p1.bb1
2 files changed, 0 insertions, 112 deletions
diff --git a/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch b/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch
deleted file mode 100644
index 20036da931..0000000000
--- a/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch
+++ /dev/null
@@ -1,111 +0,0 @@
1From 3328e98bcbf2930cd7eea3e6c92ad5dcbdf4794f Mon Sep 17 00:00:00 2001
2From: Yuanjie Huang <yuanjie.huang@windriver.com>
3Date: Wed, 24 Aug 2016 03:15:43 +0000
4Subject: [PATCH] Fix potential signed overflow in pointer arithmatic
5
6Pointer arithmatic results in implementation defined signed integer
7type, so that 's - src' in strlcpy and others may trigger signed overflow.
8In case of compilation by gcc or clang with -ftrapv option, the overflow
9would lead to program abort.
10
11Upstream-Status: Submitted [http://bugzilla.mindrot.org/show_bug.cgi?id=2608]
12
13Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
14
15Complete the fix
16Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
17---
18 openbsd-compat/strlcat.c | 10 +++++++---
19 openbsd-compat/strlcpy.c | 8 ++++++--
20 openbsd-compat/strnlen.c | 8 ++++++--
21 3 files changed, 19 insertions(+), 7 deletions(-)
22
23diff --git a/openbsd-compat/strlcat.c b/openbsd-compat/strlcat.c
24index bcc1b61..124e1e3 100644
25--- a/openbsd-compat/strlcat.c
26+++ b/openbsd-compat/strlcat.c
27@@ -23,6 +23,7 @@
28
29 #include <sys/types.h>
30 #include <string.h>
31+#include <stdint.h>
32
33 /*
34 * Appends src to string dst of size siz (unlike strncat, siz is the
35@@ -42,7 +43,7 @@ strlcat(char *dst, const char *src, size_t siz)
36 /* Find the end of dst and adjust bytes left but don't go past end */
37 while (n-- != 0 && *d != '\0')
38 d++;
39- dlen = d - dst;
40+ dlen = (uintptr_t)d - (uintptr_t)dst;
41 n = siz - dlen;
42
43 if (n == 0)
44@@ -55,8 +56,11 @@ strlcat(char *dst, const char *src, size_t siz)
45 s++;
46 }
47 *d = '\0';
48-
49- return(dlen + (s - src)); /* count does not include NUL */
50+ /*
51+ * Cast pointers to unsigned type before calculation, to avoid signed
52+ * overflow when the string ends where the MSB has changed.
53+ */
54+ return (dlen + ((uintptr_t)s - (uintptr_t)src)); /* count does not include NUL */
55 }
56
57 #endif /* !HAVE_STRLCAT */
58diff --git a/openbsd-compat/strlcpy.c b/openbsd-compat/strlcpy.c
59index b4b1b60..b06f374 100644
60--- a/openbsd-compat/strlcpy.c
61+++ b/openbsd-compat/strlcpy.c
62@@ -23,6 +23,7 @@
63
64 #include <sys/types.h>
65 #include <string.h>
66+#include <stdint.h>
67
68 /*
69 * Copy src to string dst of size siz. At most siz-1 characters
70@@ -51,8 +52,11 @@ strlcpy(char *dst, const char *src, size_t siz)
71 while (*s++)
72 ;
73 }
74-
75- return(s - src - 1); /* count does not include NUL */
76+ /*
77+ * Cast pointers to unsigned type before calculation, to avoid signed
78+ * overflow when the string ends where the MSB has changed.
79+ */
80+ return ((uintptr_t)s - (uintptr_t)src - 1); /* count does not include NUL */
81 }
82
83 #endif /* !HAVE_STRLCPY */
84diff --git a/openbsd-compat/strnlen.c b/openbsd-compat/strnlen.c
85index 7ad3573..7040f1f 100644
86--- a/openbsd-compat/strnlen.c
87+++ b/openbsd-compat/strnlen.c
88@@ -23,6 +23,7 @@
89 #include <sys/types.h>
90
91 #include <string.h>
92+#include <stdint.h>
93
94 size_t
95 strnlen(const char *str, size_t maxlen)
96@@ -31,7 +32,10 @@ strnlen(const char *str, size_t maxlen)
97
98 for (cp = str; maxlen != 0 && *cp != '\0'; cp++, maxlen--)
99 ;
100-
101- return (size_t)(cp - str);
102+ /*
103+ * Cast pointers to unsigned type before calculation, to avoid signed
104+ * overflow when the string ends where the MSB has changed.
105+ */
106+ return (size_t)((uintptr_t)cp - (uintptr_t)str);
107 }
108 #endif
109--
1102.17.1
111
diff --git a/meta/recipes-connectivity/openssh/openssh_9.7p1.bb b/meta/recipes-connectivity/openssh/openssh_9.7p1.bb
index 4a08c0bd66..4f20616295 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.7p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.7p1.bb
@@ -22,7 +22,6 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
22 file://sshdgenkeys.service \ 22 file://sshdgenkeys.service \
23 file://volatiles.99_sshd \ 23 file://volatiles.99_sshd \
24 file://run-ptest \ 24 file://run-ptest \
25 file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \
26 file://sshd_check_keys \ 25 file://sshd_check_keys \
27 file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \ 26 file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \
28 file://0001-systemd-Add-optional-support-for-systemd-sd_notify.patch \ 27 file://0001-systemd-Add-optional-support-for-systemd-sd_notify.patch \