testing/zlib
SHA256
3
0
Fork 0
forked from pool/zlib
Code Pull Requests Activity

* zlib-bnc1003580.patch CVE-2016-9843

Browse Source 
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/zlib?expand=0&rev=34
This commit is contained in:
Tomáš Chvátal 2016-12-12 10:56:26 +00:00 committed by Git OBS Bridge
parent 6c4d47582b
commit 99f0f688c8
3 changed files with 1 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
zlib-CVE-2016-9843.patch
View File

@ -1,49 +0,0 @@
From d1d577490c15a0c6862473d7576352a9f18ef811 Mon Sep 17 00:00:00 2001
From: Mark Adler <madler@alumni.caltech.edu>
Date: Wed, 28 Sep 2016 20:20:25 -0700
Subject: [PATCH] Avoid pre-decrement of pointer in big-endian CRC calculation.
There was a small optimization for PowerPCs to pre-increment a
pointer when accessing a word, instead of post-incrementing. This
required prefacing the loop with a decrement of the pointer,
possibly pointing before the object passed. This is not compliant
with the C standard, for which decrementing a pointer before its
allocated memory is undefined. When tested on a modern PowerPC
with a modern compiler, the optimization no longer has any effect.
Due to all that, and per the recommendation of a security audit of
the zlib code by Trail of Bits and TrustInSoft, in support of the
Mozilla Foundation, this "optimization" was removed, in order to
avoid the possibility of undefined behavior.
---
crc32.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/crc32.c b/crc32.c
index 979a719..05733f4 100644
--- a/crc32.c
+++ b/crc32.c
@@ -278,7 +278,7 @@ local unsigned long crc32_little(crc, buf, len)
}
/* ========================================================================= */
-#define DOBIG4 c ^= *++buf4; \
+#define DOBIG4 c ^= *buf4++; \
c = crc_table[4][c & 0xff] ^ crc_table[5][(c >> 8) & 0xff] ^ \
crc_table[6][(c >> 16) & 0xff] ^ crc_table[7][c >> 24]
#define DOBIG32 DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4
@@ -300,7 +300,6 @@ local unsigned long crc32_big(crc, buf, len)
}
buf4 = (const z_crc_t FAR *)(const void FAR *)buf;
- buf4--;
while (len >= 32) {
DOBIG32;
len -= 32;
@@ -309,7 +308,6 @@ local unsigned long crc32_big(crc, buf, len)
DOBIG4;
len -= 4;
}
- buf4++;
buf = (const unsigned char FAR *)buf4;
if (len) do {

8
zlib.changes
View File

@ -1,9 +1,3 @@
-------------------------------------------------------------------
Mon Dec 12 10:53:19 UTC 2016 - tchvatal@suse.com
- Add fix for bnc#1013882 CVE-2016-9843:
* zlib-CVE-2016-9843.patch
-------------------------------------------------------------------
Sun Dec 4 12:47:51 UTC 2016 - tchvatal@suse.com
@ -11,7 +5,7 @@ Sun Dec 4 12:47:51 UTC 2016 - tchvatal@suse.com
* zlib-bnc1003577.patch
* zlib-bnc1003579-part2.patch
* zlib-bnc1003579.patch
* zlib-bnc1003580.patch
* zlib-bnc1003580.patch CVE-2016-9843
-------------------------------------------------------------------
Thu Sep 24 20:21:46 UTC 2015 - jengelh@inai.de

2
zlib.spec
View File

@ -37,7 +37,6 @@ Patch2: zlib-bnc1003577.patch
Patch3: zlib-bnc1003579-part2.patch
Patch4: zlib-bnc1003579.patch
Patch5: zlib-bnc1003580.patch
Patch6: zlib-CVE-2016-9843.patch
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: libtool
@ -125,7 +124,6 @@ developing applications which use minizip.
%patch3 -p1
%patch4 -p1
%patch5 -p1
%patch6 -p1
%build
export LDFLAGS="-Wl,-z,relro,-z,now"