From 0c5a6b5f96b1a794bb5f7a9ccc46681c991620b19cf93882653b2896855dd6f5 Mon Sep 17 00:00:00 2001 From: Andreas Schwab Date: Wed, 22 Jan 2020 11:23:14 +0000 Subject: [PATCH] Accepting request 766269 from home:Andreas_Schwab:Factory - backtrace-powerpc.patch: Fix array overflow in backtrace on PowerPC (bsc#1158996, BZ #25423) - Drop support for pluggable gconv modules (bsc#1159851) OBS-URL: https://build.opensuse.org/request/show/766269 OBS-URL: https://build.opensuse.org/package/show/Base:System/glibc?expand=0&rev=548 --- backtrace-powerpc.patch | 66 +++++++++++++++++++++++++++++++++++++++++ glibc.changes | 7 +++++ glibc.spec | 10 +++---- 3 files changed, 77 insertions(+), 6 deletions(-) create mode 100644 backtrace-powerpc.patch diff --git a/backtrace-powerpc.patch b/backtrace-powerpc.patch new file mode 100644 index 0000000..391f213 --- /dev/null +++ b/backtrace-powerpc.patch @@ -0,0 +1,66 @@ +From d93769405996dfc11d216ddbe415946617b5a494 Mon Sep 17 00:00:00 2001 +From: Andreas Schwab +Date: Mon, 20 Jan 2020 17:01:50 +0100 +Subject: [PATCH] Fix array overflow in backtrace on PowerPC (bug 25423) + +When unwinding through a signal frame the backtrace function on PowerPC +didn't check array bounds when storing the frame address. Fixes commit +d400dcac5e ("PowerPC: fix backtrace to handle signal trampolines"). +--- + debug/tst-backtrace5.c | 12 ++++++++++++ + sysdeps/powerpc/powerpc32/backtrace.c | 2 ++ + sysdeps/powerpc/powerpc64/backtrace.c | 2 ++ + 3 files changed, 16 insertions(+) + +diff --git a/debug/tst-backtrace5.c b/debug/tst-backtrace5.c +index e7ce410845..b2f46160e7 100644 +--- a/debug/tst-backtrace5.c ++++ b/debug/tst-backtrace5.c +@@ -89,6 +89,18 @@ handle_signal (int signum) + } + /* Symbol names are not available for static functions, so we do not + check do_test. */ ++ ++ /* Check that backtrace does not return more than what fits in the array ++ (bug 25423). */ ++ for (int j = 0; j < NUM_FUNCTIONS; j++) ++ { ++ n = backtrace (addresses, j); ++ if (n > j) ++ { ++ FAIL (); ++ return; ++ } ++ } + } + + NO_INLINE int +diff --git a/sysdeps/powerpc/powerpc32/backtrace.c b/sysdeps/powerpc/powerpc32/backtrace.c +index 7c2d4726f8..d1456c8ae4 100644 +--- a/sysdeps/powerpc/powerpc32/backtrace.c ++++ b/sysdeps/powerpc/powerpc32/backtrace.c +@@ -114,6 +114,8 @@ __backtrace (void **array, int size) + } + if (gregset) + { ++ if (count + 1 == size) ++ break; + array[++count] = (void*)((*gregset)[PT_NIP]); + current = (void*)((*gregset)[PT_R1]); + } +diff --git a/sysdeps/powerpc/powerpc64/backtrace.c b/sysdeps/powerpc/powerpc64/backtrace.c +index 65c260ab76..8a53a1088f 100644 +--- a/sysdeps/powerpc/powerpc64/backtrace.c ++++ b/sysdeps/powerpc/powerpc64/backtrace.c +@@ -87,6 +87,8 @@ __backtrace (void **array, int size) + if (is_sigtramp_address (current->return_address)) + { + struct signal_frame_64 *sigframe = (struct signal_frame_64*) current; ++ if (count + 1 == size) ++ break; + array[++count] = (void*) sigframe->uc.uc_mcontext.gp_regs[PT_NIP]; + current = (void*) sigframe->uc.uc_mcontext.gp_regs[PT_R1]; + } +-- +2.25.0 + diff --git a/glibc.changes b/glibc.changes index 2e59174..e6871fc 100644 --- a/glibc.changes +++ b/glibc.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Tue Jan 21 15:08:13 UTC 2020 - Andreas Schwab + +- backtrace-powerpc.patch: Fix array overflow in backtrace on PowerPC + (bsc#1158996, BZ #25423) +- Drop support for pluggable gconv modules (bsc#1159851) + ------------------------------------------------------------------- Mon Dec 9 13:21:34 UTC 2019 - Andreas Schwab diff --git a/glibc.spec b/glibc.spec index fa10f98..ee8b659 100644 --- a/glibc.spec +++ b/glibc.spec @@ -1,7 +1,7 @@ # # spec file for package glibc # -# Copyright (c) 2019 SUSE LLC +# Copyright (c) 2020 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -263,6 +263,8 @@ Patch1000: malloc-info-whitespace.patch Patch1001: riscv-vfork.patch # PATCH-FIX-UPSTREAM rtld: Check __libc_enable_secure before honoring LD_PREFER_MAP_32BIT_EXEC (CVE-2019-19126, BZ #25204) Patch1002: prefer-map-32bit-exec.patch +# PATCH-FIX-UPSTREAM Fix array overflow in backtrace on PowerPC (BZ #25423) +Patch1003: backtrace-powerpc.patch ### # Patches awaiting upstream approval @@ -475,6 +477,7 @@ makedb: A program to create a database for nss %patch1000 -p1 %patch1001 -p1 %patch1002 -p1 +%patch1003 -p1 %patch2000 -p1 %patch2001 -p1 @@ -1044,11 +1047,6 @@ end %postun -p /sbin/ldconfig %post locale-base -for l in /usr/share/locale/locale.alias %{_libdir}/gconv/gconv-modules; do - [ -d "$l.d" ] || continue - echo "###X# The following is autogenerated from extra files in the .d directory:" >>"$l" - cat "$l.d"/* >>"$l" -done /usr/sbin/iconvconfig %post info