Crashes on invalid input in IBM gconv modules (CVE-2014-6040, #1135842)
This commit is contained in:
Siddhesh Poyarekar
parent
48e40fc12c
commit
3d4581ecbb
154
glibc-rh1135842.patch
Normal file
154
glibc-rh1135842.patch
Normal file
@ -0,0 +1,154 @@
|
||||
commit 41488498b6d9440ee66ab033808cce8323bba7ac
|
||||
Author: Florian Weimer <fweimer@redhat.com>
|
||||
Date: Wed Sep 3 19:45:43 2014 +0200
|
||||
|
||||
CVE-2014-6040: Crashes on invalid input in IBM gconv modules [BZ #17325]
|
||||
|
||||
These changes are based on the fix for BZ #14134 in commit
|
||||
6e230d11837f3ae7b375ea69d7905f0d18eb79e5.
|
||||
|
||||
diff --git a/iconvdata/Makefile b/iconvdata/Makefile
|
||||
index 0a410a1..b6327d6 100644
|
||||
--- a/iconvdata/Makefile
|
||||
+++ b/iconvdata/Makefile
|
||||
@@ -297,6 +297,7 @@ $(objpfx)tst-iconv7.out: $(objpfx)gconv-modules \
|
||||
$(objpfx)iconv-test.out: run-iconv-test.sh $(objpfx)gconv-modules \
|
||||
$(addprefix $(objpfx),$(modules.so)) \
|
||||
$(common-objdir)/iconv/iconv_prog TESTS
|
||||
+ iconv_modules="$(modules)" \
|
||||
$(SHELL) $< $(common-objdir) '$(test-wrapper)' > $@
|
||||
|
||||
$(objpfx)tst-tables.out: tst-tables.sh $(objpfx)gconv-modules \
|
||||
diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c
|
||||
index 0b5484f..cf80993 100644
|
||||
--- a/iconvdata/ibm1364.c
|
||||
+++ b/iconvdata/ibm1364.c
|
||||
@@ -221,7 +221,8 @@ enum
|
||||
++rp2; \
|
||||
\
|
||||
uint32_t res; \
|
||||
- if (__builtin_expect (ch < rp2->start, 0) \
|
||||
+ if (__builtin_expect (rp2->start == 0xffff, 0) \
|
||||
+ || __builtin_expect (ch < rp2->start, 0) \
|
||||
|| (res = DB_TO_UCS4[ch + rp2->idx], \
|
||||
__builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \
|
||||
{ \
|
||||
diff --git a/iconvdata/ibm932.c b/iconvdata/ibm932.c
|
||||
index f5dca59..aa69d65 100644
|
||||
--- a/iconvdata/ibm932.c
|
||||
+++ b/iconvdata/ibm932.c
|
||||
@@ -74,11 +74,12 @@
|
||||
} \
|
||||
\
|
||||
ch = (ch * 0x100) + inptr[1]; \
|
||||
+ /* ch was less than 0xfd. */ \
|
||||
+ assert (ch < 0xfd00); \
|
||||
while (ch > rp2->end) \
|
||||
++rp2; \
|
||||
\
|
||||
- if (__builtin_expect (rp2 == NULL, 0) \
|
||||
- || __builtin_expect (ch < rp2->start, 0) \
|
||||
+ if (__builtin_expect (ch < rp2->start, 0) \
|
||||
|| (res = __ibm932db_to_ucs4[ch + rp2->idx], \
|
||||
__builtin_expect (res, '\1') == 0 && ch !=0)) \
|
||||
{ \
|
||||
diff --git a/iconvdata/ibm933.c b/iconvdata/ibm933.c
|
||||
index f46dfb5..461fb5e 100644
|
||||
--- a/iconvdata/ibm933.c
|
||||
+++ b/iconvdata/ibm933.c
|
||||
@@ -162,7 +162,7 @@ enum
|
||||
while (ch > rp2->end) \
|
||||
++rp2; \
|
||||
\
|
||||
- if (__builtin_expect (rp2 == NULL, 0) \
|
||||
+ if (__builtin_expect (rp2->start == 0xffff, 0) \
|
||||
|| __builtin_expect (ch < rp2->start, 0) \
|
||||
|| (res = __ibm933db_to_ucs4[ch + rp2->idx], \
|
||||
__builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \
|
||||
diff --git a/iconvdata/ibm935.c b/iconvdata/ibm935.c
|
||||
index a8e4e6c..132d816 100644
|
||||
--- a/iconvdata/ibm935.c
|
||||
+++ b/iconvdata/ibm935.c
|
||||
@@ -162,7 +162,7 @@ enum
|
||||
while (ch > rp2->end) \
|
||||
++rp2; \
|
||||
\
|
||||
- if (__builtin_expect (rp2 == NULL, 0) \
|
||||
+ if (__builtin_expect (rp2->start == 0xffff, 0) \
|
||||
|| __builtin_expect (ch < rp2->start, 0) \
|
||||
|| (res = __ibm935db_to_ucs4[ch + rp2->idx], \
|
||||
__builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \
|
||||
diff --git a/iconvdata/ibm937.c b/iconvdata/ibm937.c
|
||||
index 239be61..69b154d 100644
|
||||
--- a/iconvdata/ibm937.c
|
||||
+++ b/iconvdata/ibm937.c
|
||||
@@ -162,7 +162,7 @@ enum
|
||||
while (ch > rp2->end) \
|
||||
++rp2; \
|
||||
\
|
||||
- if (__builtin_expect (rp2 == NULL, 0) \
|
||||
+ if (__builtin_expect (rp2->start == 0xffff, 0) \
|
||||
|| __builtin_expect (ch < rp2->start, 0) \
|
||||
|| (res = __ibm937db_to_ucs4[ch + rp2->idx], \
|
||||
__builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \
|
||||
diff --git a/iconvdata/ibm939.c b/iconvdata/ibm939.c
|
||||
index 5d0db36..9936e2c 100644
|
||||
--- a/iconvdata/ibm939.c
|
||||
+++ b/iconvdata/ibm939.c
|
||||
@@ -162,7 +162,7 @@ enum
|
||||
while (ch > rp2->end) \
|
||||
++rp2; \
|
||||
\
|
||||
- if (__builtin_expect (rp2 == NULL, 0) \
|
||||
+ if (__builtin_expect (rp2->start == 0xffff, 0) \
|
||||
|| __builtin_expect (ch < rp2->start, 0) \
|
||||
|| (res = __ibm939db_to_ucs4[ch + rp2->idx], \
|
||||
__builtin_expect (res, L'\1') == L'\0' && ch != '\0')) \
|
||||
diff --git a/iconvdata/ibm943.c b/iconvdata/ibm943.c
|
||||
index be0c14f..c5d5742 100644
|
||||
--- a/iconvdata/ibm943.c
|
||||
+++ b/iconvdata/ibm943.c
|
||||
@@ -75,11 +75,12 @@
|
||||
} \
|
||||
\
|
||||
ch = (ch * 0x100) + inptr[1]; \
|
||||
+ /* ch was less than 0xfd. */ \
|
||||
+ assert (ch < 0xfd00); \
|
||||
while (ch > rp2->end) \
|
||||
++rp2; \
|
||||
\
|
||||
- if (__builtin_expect (rp2 == NULL, 0) \
|
||||
- || __builtin_expect (ch < rp2->start, 0) \
|
||||
+ if (__builtin_expect (ch < rp2->start, 0) \
|
||||
|| (res = __ibm943db_to_ucs4[ch + rp2->idx], \
|
||||
__builtin_expect (res, '\1') == 0 && ch !=0)) \
|
||||
{ \
|
||||
diff --git a/iconvdata/run-iconv-test.sh b/iconvdata/run-iconv-test.sh
|
||||
index c98c929..5dfb69f 100755
|
||||
--- a/iconvdata/run-iconv-test.sh
|
||||
+++ b/iconvdata/run-iconv-test.sh
|
||||
@@ -184,6 +184,24 @@ while read utf8 from filename; do
|
||||
|
||||
done < TESTS2
|
||||
|
||||
+# Check for crashes in decoders.
|
||||
+printf '\016\377\377\377\377\377\377\377' > $temp1
|
||||
+for from in $iconv_modules ; do
|
||||
+ echo $ac_n "test decoder $from $ac_c"
|
||||
+ PROG=`eval echo $ICONV`
|
||||
+ if $PROG < $temp1 >/dev/null 2>&1 ; then
|
||||
+ : # fall through
|
||||
+ else
|
||||
+ status=$?
|
||||
+ if test $status -gt 1 ; then
|
||||
+ echo "/FAILED"
|
||||
+ failed=1
|
||||
+ continue
|
||||
+ fi
|
||||
+ fi
|
||||
+ echo "OK"
|
||||
+done
|
||||
+
|
||||
exit $failed
|
||||
# Local Variables:
|
||||
# mode:shell-script
|
||||
@ -1,6 +1,6 @@
|
||||
%define glibcsrcdir glibc-2.18
|
||||
%define glibcversion 2.18
|
||||
%define glibcrelease 16%{?dist}
|
||||
%define glibcrelease 18%{?dist}
|
||||
# Pre-release tarballs are pulled in from git using a command that is
|
||||
# effectively:
|
||||
#
|
||||
@ -198,6 +198,7 @@ Patch1005: %{name}-rh1019452.patch
|
||||
Patch1006: %{name}-rh1118581.patch
|
||||
Patch1007: %{name}-rh1118581-2.patch
|
||||
Patch1008: %{name}-rh1104400.patch
|
||||
Patch1009: %{name}-rh1135842.patch
|
||||
|
||||
#
|
||||
# Patches submitted, but not yet approved upstream.
|
||||
@ -580,6 +581,7 @@ package or when debugging this package.
|
||||
%patch1006 -p1
|
||||
%patch1007 -p1
|
||||
%patch1008 -p1
|
||||
%patch1009 -p1
|
||||
|
||||
##############################################################################
|
||||
# %%prep - Additional prep required...
|
||||
@ -1669,6 +1671,9 @@ rm -f *.filelist*
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Mon Feb 23 2015 Siddhesh Poyarekar <siddhesh@redhat.com> - 2.18-18
|
||||
- Crashes on invalid input in IBM gconv modules (CVE-2014-6040, #1135842).
|
||||
|
||||
* Wed Oct 1 2014 Siddhesh Poyarekar <siddhesh@redhat.com> - 2.18-17
|
||||
- Fix lll_unlock twice in pthread_cond_broadcast (#1104400).
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user