From 484f119f04b910565070ac74a391971fffbfb91a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <[email protected]> Date: Wed, 8 Mar 2017 11:58:24 +0100 Subject: Fix an use-after-free in substr() that modifies a magic variable
--- ...-copy-the-source-when-inside-the-dest-in-.patch | 104 +++++++++++++++++++++ perl.spec | 7 ++ 2 files changed, 111 insertions(+) create mode 100644 perl-5.22.3-perl-129340-copy-the-source-when-inside-the-dest-in-.patch diff --git a/perl-5.22.3-perl-129340-copy-the-source-when-inside-the-dest-in-.patch b/perl-5.22.3-perl-129340-copy-the-source-when-inside-the-dest-in-.patch new file mode 100644 index 0000000..e44385b --- /dev/null +++ b/perl-5.22.3-perl-129340-copy-the-source-when-inside-the-dest-in-.patch @@ -0,0 +1,104 @@ +From ee45d0c2ef62617f75c7f99aaaa44ab1225864af Mon Sep 17 00:00:00 2001 +From: Tony Cook <[email protected]> +Date: Mon, 20 Feb 2017 11:02:21 +1100 +Subject: [PATCH] (perl #129340) copy the source when inside the dest in + sv_insert_flags() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Ported to 5.22.3: + +commit e7a8a8aac45d42d72d1586227ca51771f193f5dc +Author: Tony Cook <[email protected]> +Date: Mon Feb 20 11:02:21 2017 +1100 + + (perl #129340) copy the source when inside the dest in sv_insert_flags() + +Signed-off-by: Petr Písař <[email protected]> +--- + embed.fnc | 2 +- + proto.h | 2 +- + sv.c | 12 +++++++++++- + t/op/substr.t | 5 ++++- + 4 files changed, 17 insertions(+), 4 deletions(-) + +diff --git a/embed.fnc b/embed.fnc +index b26ba18..3dbf9e8 100644 +--- a/embed.fnc ++++ b/embed.fnc +@@ -1442,7 +1442,7 @@ Amdb |void |sv_insert |NN SV *const bigstr|const STRLEN offset \ + |const STRLEN len|NN const char *const little \ + |const STRLEN littlelen + Apd |void |sv_insert_flags|NN SV *const bigstr|const STRLEN offset|const STRLEN len \ +- |NN const char *const little|const STRLEN littlelen|const U32 flags ++ |NN const char *little|const STRLEN littlelen|const U32 flags + Apd |int |sv_isa |NULLOK SV* sv|NN const char *const name + Apd |int |sv_isobject |NULLOK SV* sv + Apd |STRLEN |sv_len |NULLOK SV *const sv +diff --git a/proto.h b/proto.h +index ab78202..f82c62e 100644 +--- a/proto.h ++++ b/proto.h +@@ -4373,7 +4373,7 @@ PERL_CALLCONV void Perl_sv_inc_nomg(pTHX_ SV *const sv); + #define PERL_ARGS_ASSERT_SV_INSERT \ + assert(bigstr); assert(little) + +-PERL_CALLCONV void Perl_sv_insert_flags(pTHX_ SV *const bigstr, const STRLEN offset, const STRLEN len, const char *const little, const STRLEN littlelen, const U32 flags) ++PERL_CALLCONV void Perl_sv_insert_flags(pTHX_ SV *const bigstr, const STRLEN offset, const STRLEN len, const char *little, const STRLEN littlelen, const U32 flags); + __attribute__nonnull__(pTHX_1) + __attribute__nonnull__(pTHX_4); + #define PERL_ARGS_ASSERT_SV_INSERT_FLAGS \ +diff --git a/sv.c b/sv.c +index 263d27b..5329f9e 100644 +--- a/sv.c ++++ b/sv.c +@@ -6301,7 +6301,7 @@ C<SvPV_force_flags> that applies to C<bigstr>. + */ + + void +-Perl_sv_insert_flags(pTHX_ SV *const bigstr, const STRLEN offset, const STRLEN len, const char *const little, const STRLEN littlelen, const U32 flags) ++Perl_sv_insert_flags(pTHX_ SV *const bigstr, const STRLEN offset, const STRLEN len, const char *little, const STRLEN littlelen, const U32 flags) + { + char *big; + char *mid; +@@ -6314,6 +6314,16 @@ Perl_sv_insert_flags(pTHX_ SV *const bigstr, const STRLEN offset, const STRLEN l + + SvPV_force_flags(bigstr, curlen, flags); + (void)SvPOK_only_UTF8(bigstr); ++ ++ if (little >= SvPVX(bigstr) && ++ little < SvPVX(bigstr) + (SvLEN(bigstr) ? SvLEN(bigstr) : SvCUR(bigstr))) { ++ /* little is a pointer to within bigstr, since we can reallocate bigstr, ++ or little...little+littlelen might overlap offset...offset+len we make a copy ++ */ ++ little = savepvn(little, littlelen); ++ SAVEFREEPV(little); ++ } ++ + if (offset + len > curlen) { + SvGROW(bigstr, offset+len+1); + Zero(SvPVX(bigstr)+curlen, offset+len-curlen, char); +diff --git a/t/op/substr.t b/t/op/substr.t +index 71e9e89..7d8f3e0 100644 +--- a/t/op/substr.t ++++ b/t/op/substr.t +@@ -22,7 +22,7 @@ $SIG{__WARN__} = sub { + } + }; + +-plan(388); ++plan(389); + + run_tests() unless caller; + +@@ -868,3 +868,6 @@ is($destroyed, 1, 'Timely scalar destruction with lvalue substr'); + + is($result_3363, "best", "ref-to-substr retains lvalue-ness under recursion [perl #3363]"); + } ++ ++# failed with ASAN ++fresh_perl_is('$0 = "/usr/bin/perl"; substr($0, 0, 0, $0)', '', {}, "(perl #129340) substr() with source in target"); +-- +2.7.4 + diff --git a/perl.spec b/perl.spec index 78e4d1a..1a17a98 100644 --- a/perl.spec +++ b/perl.spec @@ -207,6 +207,10 @@ Patch69: perl-5.25.9-perl-129061-CURLYX-nodes-can-be-studied-more-than-on # in upstream after 5.25.9 Patch70: perl-5.24.1-perl-130815-fix-ck_return-null-pointer-deref-on-malf.patch +# Fix an use-after-free in substr() that modifies a magic variable, RT#129340, +# in upstream after 5.25.9 +Patch71: perl-5.22.3-perl-129340-copy-the-source-when-inside-the-dest-in-.patch + # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048 Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch @@ -2519,6 +2523,7 @@ Perl extension for Version Objects %patch68 -p1 %patch69 -p1 %patch70 -p1 +%patch71 -p1 %patch200 -p1 %patch201 -p1 @@ -2574,6 +2579,7 @@ perl -x patchlevel.h \ 'Fedora Patch67: Fix a buffer overrun with format and "use bytes" (RT#130703)' \ 'Fedora Patch68: Fix a buffer overflow when studying some regexps repeatedly (RT#129281, RT#129061)' \ 'Fedora Patch70: Fix a null-pointer dereference on malformed code (RT#130815)' \ + 'Fedora Patch71: Fix an use-after-free in substr() that modifies a magic variable (RT#129340)' \ 'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \ 'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \ %{nil} @@ -4828,6 +4834,7 @@ popd %changelog * Wed Mar 08 2017 Petr Pisar <[email protected]> - 4:5.22.3-370 - Fix a null-pointer dereference on malformed code (RT#130815) +- Fix an use-after-free in substr() that modifies a magic variable (RT#129340) * Fri Feb 17 2017 Petr Pisar <[email protected]> - 4:5.22.3-369 - Fix a crash when compiling a regexp with impossible quantifiers (RT#130561) -- cgit v1.1 https://src.fedoraproject.org/cgit/perl.git/commit/?h=f24&id=484f119f04b910565070ac74a391971fffbfb91a _______________________________________________ perl-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
