Hello community,
here is the log from the commit of package glibc for openSUSE:Factory checked
in at 2013-09-13 14:43:41
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/glibc (Old)
and /work/SRC/openSUSE:Factory/.glibc.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "glibc"
Changes:
--------
--- /work/SRC/openSUSE:Factory/glibc/glibc-testsuite.changes 2013-09-12
07:09:25.000000000 +0200
+++ /work/SRC/openSUSE:Factory/.glibc.new/glibc-testsuite.changes
2013-09-13 14:43:42.000000000 +0200
@@ -1,0 +2,6 @@
+Thu Sep 12 13:42:23 UTC 2013 - sch...@suse.de
+
+- malloc-overflows.patch: Fix integer overflows in malloc (CVE-2013-4332,
+ bnc#839870)
+
+-------------------------------------------------------------------
glibc-utils.changes: same change
glibc.changes: same change
New:
----
malloc-overflows.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ glibc-testsuite.spec ++++++
--- /var/tmp/diff_new_pack.mhhYnQ/_old 2013-09-13 14:43:43.000000000 +0200
+++ /var/tmp/diff_new_pack.mhhYnQ/_new 2013-09-13 14:43:43.000000000 +0200
@@ -242,6 +242,8 @@
###
# PATCH-FIX-UPSTREAM Add O_TMPFILE to <fcntl.h>
Patch1000: fcntl-o-tmpfile.patch
+# PATCH-FIX-UPSTREAM Integer overflows in malloc
+Patch1001: malloc-overflows.patch
###
# Patches awaiting upstream approval
@@ -465,6 +467,7 @@
%patch306 -p1
%patch1000 -p1
+%patch1001 -p1
# XXX Disable, it breaks the testsuite, test elf/tst-audit2
# %patch2008 -p1
glibc-utils.spec: same change
glibc.spec: same change
++++++ malloc-overflows.patch ++++++
2013-09-11 Will Newton <will.new...@linaro.org>
[BZ #15857]
* malloc/malloc.c (__libc_memalign): Check the value of bytes
does not overflow.
[BZ #15856]
* malloc/malloc.c (__libc_valloc): Check the value of bytes
does not overflow.
[BZ #15855]
* malloc/malloc.c (__libc_pvalloc): Check the value of bytes
does not overflow.
Index: glibc-2.18/malloc/malloc.c
===================================================================
--- glibc-2.18.orig/malloc/malloc.c
+++ glibc-2.18/malloc/malloc.c
@@ -3015,6 +3015,13 @@ __libc_memalign(size_t alignment, size_t
/* Otherwise, ensure that it is at least a minimum chunk size */
if (alignment < MINSIZE) alignment = MINSIZE;
+ /* Check for overflow. */
+ if (bytes > SIZE_MAX - alignment - MINSIZE)
+ {
+ __set_errno (ENOMEM);
+ return 0;
+ }
+
arena_get(ar_ptr, bytes + alignment + MINSIZE);
if(!ar_ptr)
return 0;
@@ -3046,6 +3053,13 @@ __libc_valloc(size_t bytes)
size_t pagesz = GLRO(dl_pagesize);
+ /* Check for overflow. */
+ if (bytes > SIZE_MAX - pagesz - MINSIZE)
+ {
+ __set_errno (ENOMEM);
+ return 0;
+ }
+
void *(*hook) (size_t, size_t, const void *) =
force_reg (__memalign_hook);
if (__builtin_expect (hook != NULL, 0))
@@ -3082,6 +3096,13 @@ __libc_pvalloc(size_t bytes)
size_t page_mask = GLRO(dl_pagesize) - 1;
size_t rounded_bytes = (bytes + page_mask) & ~(page_mask);
+ /* Check for overflow. */
+ if (bytes > SIZE_MAX - 2*pagesz - MINSIZE)
+ {
+ __set_errno (ENOMEM);
+ return 0;
+ }
+
void *(*hook) (size_t, size_t, const void *) =
force_reg (__memalign_hook);
if (__builtin_expect (hook != NULL, 0))
--
To unsubscribe, e-mail: opensuse-commit+unsubscr...@opensuse.org
For additional commands, e-mail: opensuse-commit+h...@opensuse.org
