forked from pool/glibc
Andreas Schwab
43169f4d3a
- mempcpy-avx512.patch: Don't write beyond destination in __mempcpy_avx512_no_vzeroupper (CVE-2018-11237, bsc#1094154) - realpath-ssize-max-overflow.patch: Fix overflow in path length computation (CVE-2018-11236, bsc#1094161, BZ #22786) - Use %license also for COPYING, COPYING.LIB OBS-URL: https://build.opensuse.org/request/show/611652 OBS-URL: https://build.opensuse.org/package/show/Base:System/glibc?expand=0&rev=505
43 lines
1.4 KiB
Diff
43 lines
1.4 KiB
Diff
[BZ #23196]
|
|
CVE-2018-11237
|
|
* sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
|
|
(L(preloop_large)): Save initial destination pointer in %r11 and
|
|
use it instead of %rax after the loop.
|
|
* string/test-mempcpy.c (MIN_PAGE_SIZE): Define.
|
|
|
|
Index: glibc-2.27/string/test-mempcpy.c
|
|
===================================================================
|
|
--- glibc-2.27.orig/string/test-mempcpy.c
|
|
+++ glibc-2.27/string/test-mempcpy.c
|
|
@@ -18,6 +18,7 @@
|
|
<http://www.gnu.org/licenses/>. */
|
|
|
|
#define MEMCPY_RESULT(dst, len) (dst) + (len)
|
|
+#define MIN_PAGE_SIZE 131072
|
|
#define TEST_MAIN
|
|
#define TEST_NAME "mempcpy"
|
|
#include "test-string.h"
|
|
Index: glibc-2.27/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
|
|
===================================================================
|
|
--- glibc-2.27.orig/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
|
|
+++ glibc-2.27/sysdeps/x86_64/multiarch/memmove-avx512-no-vzeroupper.S
|
|
@@ -336,6 +336,7 @@ L(preloop_large):
|
|
vmovups (%rsi), %zmm4
|
|
vmovups 0x40(%rsi), %zmm5
|
|
|
|
+ mov %rdi, %r11
|
|
/* Align destination for access with non-temporal stores in the loop. */
|
|
mov %rdi, %r8
|
|
and $-0x80, %rdi
|
|
@@ -366,8 +367,8 @@ L(gobble_256bytes_nt_loop):
|
|
cmp $256, %rdx
|
|
ja L(gobble_256bytes_nt_loop)
|
|
sfence
|
|
- vmovups %zmm4, (%rax)
|
|
- vmovups %zmm5, 0x40(%rax)
|
|
+ vmovups %zmm4, (%r11)
|
|
+ vmovups %zmm5, 0x40(%r11)
|
|
jmp L(check)
|
|
|
|
L(preloop_large_bkw):
|