Fix a stack exhaustion problem in libiberty's name demangling code.
This commit is contained in:
Nick Clifton
parent
3edfd25eae
commit
5c29c452de
110
binutils-CVE-2019-9071.patch
Normal file
110
binutils-CVE-2019-9071.patch
Normal file
@ -0,0 +1,110 @@
|
|||||||
|
--- binutils.orig/libiberty/cp-demangle.c 2019-04-10 10:31:27.854997707 +0100
|
||||||
|
+++ binutils-2.31.1/libiberty/cp-demangle.c 2019-04-10 16:00:35.820350978 +0100
|
||||||
|
@@ -858,7 +858,7 @@ CP_STATIC_IF_GLIBCPP_V3
|
||||||
|
int
|
||||||
|
cplus_demangle_fill_name (struct demangle_component *p, const char *s, int len)
|
||||||
|
{
|
||||||
|
- if (p == NULL || s == NULL || len == 0)
|
||||||
|
+ if (p == NULL || s == NULL || len <= 0)
|
||||||
|
return 0;
|
||||||
|
p->d_printing = 0;
|
||||||
|
p->type = DEMANGLE_COMPONENT_NAME;
|
||||||
|
@@ -4032,7 +4032,7 @@ d_growable_string_callback_adapter (cons
|
||||||
|
are larger than the actual numbers encountered. */
|
||||||
|
|
||||||
|
static void
|
||||||
|
-d_count_templates_scopes (int *num_templates, int *num_scopes,
|
||||||
|
+d_count_templates_scopes (struct d_print_info *dpi,
|
||||||
|
const struct demangle_component *dc)
|
||||||
|
{
|
||||||
|
if (dc == NULL)
|
||||||
|
@@ -4052,13 +4052,13 @@ d_count_templates_scopes (int *num_templ
|
||||||
|
break;
|
||||||
|
|
||||||
|
case DEMANGLE_COMPONENT_TEMPLATE:
|
||||||
|
- (*num_templates)++;
|
||||||
|
+ dpi->num_copy_templates++;
|
||||||
|
goto recurse_left_right;
|
||||||
|
|
||||||
|
case DEMANGLE_COMPONENT_REFERENCE:
|
||||||
|
case DEMANGLE_COMPONENT_RVALUE_REFERENCE:
|
||||||
|
if (d_left (dc)->type == DEMANGLE_COMPONENT_TEMPLATE_PARAM)
|
||||||
|
- (*num_scopes)++;
|
||||||
|
+ dpi->num_saved_scopes++;
|
||||||
|
goto recurse_left_right;
|
||||||
|
|
||||||
|
case DEMANGLE_COMPONENT_QUAL_NAME:
|
||||||
|
@@ -4122,42 +4122,42 @@ d_count_templates_scopes (int *num_templ
|
||||||
|
case DEMANGLE_COMPONENT_TAGGED_NAME:
|
||||||
|
case DEMANGLE_COMPONENT_CLONE:
|
||||||
|
recurse_left_right:
|
||||||
|
- d_count_templates_scopes (num_templates, num_scopes,
|
||||||
|
- d_left (dc));
|
||||||
|
- d_count_templates_scopes (num_templates, num_scopes,
|
||||||
|
- d_right (dc));
|
||||||
|
+ /* PR 89394 - Check for too much recursion. */
|
||||||
|
+ if (dpi->recursion > DEMANGLE_RECURSION_LIMIT)
|
||||||
|
+ /* FIXME: There ought to be a way to report to the
|
||||||
|
+ user that the recursion limit has been reached. */
|
||||||
|
+ return;
|
||||||
|
+
|
||||||
|
+ ++ dpi->recursion;
|
||||||
|
+ d_count_templates_scopes (dpi, d_left (dc));
|
||||||
|
+ d_count_templates_scopes (dpi, d_right (dc));
|
||||||
|
+ -- dpi->recursion;
|
||||||
|
break;
|
||||||
|
|
||||||
|
case DEMANGLE_COMPONENT_CTOR:
|
||||||
|
- d_count_templates_scopes (num_templates, num_scopes,
|
||||||
|
- dc->u.s_ctor.name);
|
||||||
|
+ d_count_templates_scopes (dpi, dc->u.s_ctor.name);
|
||||||
|
break;
|
||||||
|
|
||||||
|
case DEMANGLE_COMPONENT_DTOR:
|
||||||
|
- d_count_templates_scopes (num_templates, num_scopes,
|
||||||
|
- dc->u.s_dtor.name);
|
||||||
|
+ d_count_templates_scopes (dpi, dc->u.s_dtor.name);
|
||||||
|
break;
|
||||||
|
|
||||||
|
case DEMANGLE_COMPONENT_EXTENDED_OPERATOR:
|
||||||
|
- d_count_templates_scopes (num_templates, num_scopes,
|
||||||
|
- dc->u.s_extended_operator.name);
|
||||||
|
+ d_count_templates_scopes (dpi, dc->u.s_extended_operator.name);
|
||||||
|
break;
|
||||||
|
|
||||||
|
case DEMANGLE_COMPONENT_FIXED_TYPE:
|
||||||
|
- d_count_templates_scopes (num_templates, num_scopes,
|
||||||
|
- dc->u.s_fixed.length);
|
||||||
|
+ d_count_templates_scopes (dpi, dc->u.s_fixed.length);
|
||||||
|
break;
|
||||||
|
|
||||||
|
case DEMANGLE_COMPONENT_GLOBAL_CONSTRUCTORS:
|
||||||
|
case DEMANGLE_COMPONENT_GLOBAL_DESTRUCTORS:
|
||||||
|
- d_count_templates_scopes (num_templates, num_scopes,
|
||||||
|
- d_left (dc));
|
||||||
|
+ d_count_templates_scopes (dpi, d_left (dc));
|
||||||
|
break;
|
||||||
|
|
||||||
|
case DEMANGLE_COMPONENT_LAMBDA:
|
||||||
|
case DEMANGLE_COMPONENT_DEFAULT_ARG:
|
||||||
|
- d_count_templates_scopes (num_templates, num_scopes,
|
||||||
|
- dc->u.s_unary_num.sub);
|
||||||
|
+ d_count_templates_scopes (dpi, dc->u.s_unary_num.sub);
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@@ -4192,8 +4192,12 @@ d_print_init (struct d_print_info *dpi,
|
||||||
|
dpi->next_copy_template = 0;
|
||||||
|
dpi->num_copy_templates = 0;
|
||||||
|
|
||||||
|
- d_count_templates_scopes (&dpi->num_copy_templates,
|
||||||
|
- &dpi->num_saved_scopes, dc);
|
||||||
|
+ d_count_templates_scopes (dpi, dc);
|
||||||
|
+ /* If we did not reach the recursion limit, then reset the
|
||||||
|
+ current recursion value back to 0, so that we can print
|
||||||
|
+ the templates. */
|
||||||
|
+ if (dpi->recursion < DEMANGLE_RECURSION_LIMIT)
|
||||||
|
+ dpi->recursion = 0;
|
||||||
|
dpi->num_copy_templates *= dpi->num_saved_scopes;
|
||||||
|
|
||||||
|
dpi->current_template = NULL;
|
||||||
@ -85,7 +85,7 @@
|
|||||||
Summary: A GNU collection of binary utilities
|
Summary: A GNU collection of binary utilities
|
||||||
Name: %{?cross}binutils%{?_with_debug:-debug}
|
Name: %{?cross}binutils%{?_with_debug:-debug}
|
||||||
Version: 2.32
|
Version: 2.32
|
||||||
Release: 10%{?dist}
|
Release: 11%{?dist}
|
||||||
License: GPLv3+
|
License: GPLv3+
|
||||||
URL: https://sourceware.org/binutils
|
URL: https://sourceware.org/binutils
|
||||||
|
|
||||||
@ -202,6 +202,10 @@ Patch17: binutils-CVE-2019-9077.patch
|
|||||||
# Lifetime: Fixed in 2.33
|
# Lifetime: Fixed in 2.33
|
||||||
Patch18: binutils-disassembling-efi-files.patch
|
Patch18: binutils-disassembling-efi-files.patch
|
||||||
|
|
||||||
|
# Purpose: Fix a stack exhaustion problem in libiberty's name demangling code.
|
||||||
|
# Lifetime: Fixed in 2.33
|
||||||
|
Patch19: binutils-CVE-2019-9071.patch
|
||||||
|
|
||||||
#----------------------------------------------------------------------------
|
#----------------------------------------------------------------------------
|
||||||
|
|
||||||
Provides: bundled(libiberty)
|
Provides: bundled(libiberty)
|
||||||
@ -346,6 +350,7 @@ Conflicts: gcc-c++ < 4.0.0
|
|||||||
%patch16 -p1
|
%patch16 -p1
|
||||||
%patch17 -p1
|
%patch17 -p1
|
||||||
%patch18 -p1
|
%patch18 -p1
|
||||||
|
%patch19 -p1
|
||||||
|
|
||||||
# We cannot run autotools as there is an exact requirement of autoconf-2.59.
|
# We cannot run autotools as there is an exact requirement of autoconf-2.59.
|
||||||
# FIXME - this is no longer true. Maybe try reinstating autotool use ?
|
# FIXME - this is no longer true. Maybe try reinstating autotool use ?
|
||||||
@ -747,6 +752,9 @@ exit 0
|
|||||||
|
|
||||||
#----------------------------------------------------------------------------
|
#----------------------------------------------------------------------------
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Apr 10 2019 Nick Clifton <nickc@redhat.com> - 2.32-11
|
||||||
|
- Fix a stack exhaustion problem in libiberty's name demangling code. (#1680658)
|
||||||
|
|
||||||
* Mon Mar 18 2019 David Abdurachmanov <david.abdurachmanov@gmail.com> - 2.32-10
|
* Mon Mar 18 2019 David Abdurachmanov <david.abdurachmanov@gmail.com> - 2.32-10
|
||||||
- Disable ld.gold on RISC-V and fix file installation issues.
|
- Disable ld.gold on RISC-V and fix file installation issues.
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user